Faith-Based Organisations And Data Protection In Nigeria: Why Audit Obligations Should Not End With Registration Exemptions

Faith-Based Organisations and Data Protection in Nigeria: Why Audit Obligations Should Not End with Registration Exemptions¹

Introduction

The Nigeria Data Protection Act² and the General Application and Implementation Directive³ provide a comprehensive legal framework for the protection of personal data in Nigeria. The Act applies its provisions to data controllers and processors domiciled, resident, or operating in Nigeria, with the principal exception being processing undertaken solely for personal or household purposes.⁴ While faith-based organisations may be exempt from registration as Data Controllers or Data Processors of Major Importance (DCPMI), this exemption is administrative and does not relieve them of their core obligations under the NDPA.

This article highlights why faith-based organisations should still conduct data protection audits, even in the absence of formal compliance teams or dedicated data protection officers. It outlines practical measures these organisations can take to safeguard personal data, including documenting processing activities, training volunteers or staff handling data, implementing simple security controls, and maintaining an audit trail. Ultimately, registration exemption should not be interpreted as a waiver of accountability, and proactive audit practices remain essential for protecting personal data, maintaining trust, and mitigating risks.

1.              Faith-Based Organisations and Registration Exemption

The General Application and Implementation Directive (GAID) provides that certain organisations, including faith-based organisations, are exempt from registration as Data Controllers or Data Processors of Major Importance (DCPMI). This exemption is specifically outlined under GAID in line with the Act⁵ and is intended to reduce the administrative burden for organisations that may not handle personal data at a scale or sensitivity typical of larger entities.

However, the NDPA clearly establishes that persons or organisations responsible for processing personal data remain subject to its data protection obligations, unless a specific exemption applies, such as processing undertaken solely for personal or household purposes. This approach is also consistent with Article 8 of the Charter of Fundamental Rights of the European Union,⁶ which recognises the right to the protection of personal data and requires that such data be processed fairly, for specified purposes, and on the basis of the consent of the individual or another legitimate basis provided by law.⁷

Faith-based organisations are not required to formally register with the Nigeria Data Protection Commission (NDPC) as DCPMIs. The exemption generally extends to certain audit returns that are mandatory for registered DCPMIs. These organisations remain subject to the core principles of the NDPA, including lawful processing, data minimisation, transparency, and security of personal data. Organisations must still document their processing activities, safeguard personal data, and maintain appropriate internal accountability measures. Where a personal data breach occurs, organisations may still be required to notify affected individuals and take appropriate corrective measures to prevent recurrence. Even where registration is not required, organisations should monitor and manage privacy risks through appropriate internal controls and, where necessary, voluntary audit processes.

In essence, GAID’s registration exemption relieves faith-based organisations of administrative filing requirements but does not remove their duty to protect personal data, manage risks, or maintain accountability. Registration exemption should therefore not be interpreted as a waiver of responsibility under the NDPA.

2.              Some Case Scenarios and Common Data Processing Activities that Faith-Based Organisations are Likely to Initiate.

Faith-based organisations often process personal data in a variety of ways as part of their everyday activities. While they may be exempt from registration under the GAID, these activities still trigger accountability obligations under the NDPA. Understanding how data is collected, stored, and used helps organisations implement effective audit practices and safeguards.

i.                Membership Registration and Personal Information Collection

Faith Based organisations routinely collect personal information when individuals become members, register for church activities, or attend such activities for the first time. This may include: names, residential addresses, phone numbers, email addresses; dates of birth, family details, emergency contact information, occupation or profession, particularly where this information is used for group, ministry, or volunteer assignments; and information provided through membership forms, registration forms, or other church administrative processes.

This information may be maintained in different formats, including: Digital databases, spreadsheets, or shared drives; Paper-based membership records and physical forms; and membership management software. These Organisations should ensure that personal information is collected only for legitimate and clearly defined purposes and that members are appropriately informed about how their information will be used.

Where the information is stored digitally, appropriate access controls and security measures should be in place to prevent unauthorised access, accidental loss, alteration, disclosure, or misuse. Physical records should similarly be stored securely and accessed only by authorised personnel. Proper retention and disposal/deletion practices are also important. Personal information should not be kept indefinitely where it is no longer required for the purpose for which it was collected.

ii.               Event Registration and Programmes:

Faith-based organisations often collect personal information when organising events, conferences, crusades, retreats, seminars, youth programmes, and other church activities. The information collected may be used to manage attendance, communicate with participants, and follow up after the event. This may include:

1. Contact details such as names, phone numbers, email addresses, and residential addresses;
2. Registration details, including attendance and participation records;
3. Information about participants’ specific programme or group affiliations, where relevant; and
4. Photographs, videos, or other recordings taken during the event for documentation, communication, or promotional purposes.

This information may be collected through online registration forms, physical sign-in sheets, event apps, or other registration platforms. Faith based Organisation should ensure that participants are appropriately informed about how their information will be used, particularly where photographs or videos may be published on websites, social media platforms, newsletters, or other public channels.

Access to registration and attendance records should also be limited to authorised personnel, and photographs, videos, and other event records should be handled securely to prevent unauthorised use or disclosure. Such activities constitute processing of personal data, and organisations should ensure consent is obtained, storage is secure, and usage is limited to intended purposes.

iii.           Media and Video Recordings

Many churches record sermons, worship sessions, conferences, crusades, or outreach events for live streaming, documentation, or later distribution. These recordings may capture faces and voices of members, visitors, and other attendees; comments, interviews, or personal testimonies shared during events; and images or recordings of children and other individuals participating in church activities. Recording, storing, or publishing these images and recordings constitutes processing of personal information. These Organisations should therefore consider the appropriate lawful basis for the recording and clearly inform attendees about the purpose of the recording, how the recordings will be used, and where they may be published.

This is particularly important in a faith-based setting because individuals may be recorded during moments of heightened personal or emotional vulnerability, such as while praying, singing, meditating, seeking spiritual guidance, or expressing strong emotions, including crying. Such recordings may reveal sensitive aspects of an individual's personal or religious life and could be embarrassing or distressing if shared without their knowledge or appropriate safeguards.

Where consent is relied upon, an appropriate consent form or privacy notice should be provided before media coverage takes place, particularly where individuals may be specifically recorded or interviewed. Churches should also provide reasonable options for individuals who do not wish to be photographed or recorded to avoid being photographed or recorded. For example, a designated seating area outside the main camera coverage may be provided and clearly identified to attendees. Churches should also take reasonable steps to ensure that recordings are securely stored, accessed only by authorised persons, and not used for purposes beyond those communicated to attendees. Where recordings are intended for public platforms such as social media, websites, or YouTube, this should be clearly communicated in advance.

iv.           Children's and Youth Programmes

Churches frequently process personal information relating to children and young people (often categorized as sensitive personal data) through Sunday school, children's ministry, youth programmes, camps, excursions, and other activities. This may include: Names, ages, and dates of birth; Parents' or guardians' contact details; Emergency contact information; Attendance records; and Photographs or videos taken during activities. Because children may require additional protection, churches should exercise particular care when collecting, using, storing, or sharing their information and should ensure that appropriate parental or guardian arrangements/consent are in place where required.

3. Why Audit Obligations Still Matter

People often trust religious leaders because of the high moral standards expected of them, which can sometimes lead to less attention being paid to the need for proper regulatory oversight. This is particularly important given that many faith-based bodies are incorporated entities under the Companies and Allied Matters Act (CAMA) as non-profit organisations.⁸ Although they may enjoy tax exemptions on revenue derived from their charitable or religious activities, this does not remove their obligations under corporate law, including the requirement to file periodic annual returns.⁹ The NDPA adopts a broad approach to data protection. The Act¹⁰ applies its provisions to data controllers and processors domiciled, resident, or operating in Nigeria, with the principal exception being processing undertaken solely for personal or household purposes. Unlike the NDPA, the EU-GDPR provides specific provisions for religious organisations, permitting them to process personal data in the course of their legitimate activities, subject to appropriate safeguards and generally limited to members, former members, or individuals who maintain regular contact with the organisation.¹¹

Even where a faith-based organisation is exempt from registration under the GAID, this should not give the erroneous impression that it is exempt from its wider obligations under the NDPA. The organisation remains responsible for ensuring that personal data is collected, used, stored, and shared in a lawful, fair, transparent, and secure manner. Regular data protection audits therefore remain important for demonstrating that appropriate measures are in place and that the organisation takes its data protection responsibilities seriously.

Accountability is a key aspect of data protection compliance. Organisations should not only comply with data protection requirements but should also be able to demonstrate the steps they have taken to achieve compliance. A data protection audit provides an opportunity to review the organisation’s data handling practices, assess existing policies and procedures, identify areas of weakness, and document measures taken to address any identified gaps. This enables the organisation to demonstrate that its processing activities are aligned with applicable data protection principles, irrespective of whether it is required to register with the NDPC.

4.           Practical Steps for Faith-Based Organisations

Even where a faith-based organisation does not have a dedicated Data Protection Officer, IT department, or HR team, it can still take practical steps to comply with the NDPA and demonstrate accountability. Data protection does not necessarily require complex systems  or  significant  resources.  Simple,  well-documented  processes,  clear responsibilities, and regular internal reviews can go a long way towards protecting personal data and reducing the risk of misuse or loss.

i.                Documenting Data Processing

Organisations should maintain a simple record of the personal data they collect, store, use, or share and the purposes for which the information is processed. This may include member donation and payment records, attendance and event registration records, and counselling information. Keeping a basic record of these activities helps the organisation understand what personal data it holds, where it is kept, who has access to it, and why it is needed. It also provides useful evidence of accountability during an internal review or regulatory inquiry.

ii.               Training Volunteers and Staff

Volunteers and staff are often directly involved in handling members’ personal information and may therefore be an important part of the organisation’s data protection arrangements. They should receive basic guidance on confidentiality, appropriate handling and storage of personal information, and how to recognise and report a suspected data breach. Training does not have to be lengthy or complicated; short awareness sessions, written guidelines, or periodic reminders can help reduce mistakes and encourage responsible handling of personal data.

iii.             Implementing Basic Security Controls

Faith-based organisations can adopt simple security measures to protect the personal information they hold. These may include using passwords on computers and mobile devices, restricting access to sensitive records to authorised persons, regularly backing up important digital records, and securely storing physical files in lockable cabinets or restricted-access areas. Where information is shared electronically, organisations should also consider whether the method of sharing is appropriate and secure. These basic measures can significantly reduce the risk of unauthorised access, accidental loss, disclosure, or misuse.

iv.             Maintaining an Audit Trail

Organisations should maintain basic records of important data protection activities and incidents. This may include records of when personal information is collected or updated, who has access to sensitive information, any suspected or confirmed

data breaches, and the steps taken to address them. Maintaining an audit trail helps the organisation demonstrate accountability, identify recurring weaknesses, and show that appropriate action was taken when an issue was identified. It also provides a useful record for reviewing and improving the organisation’s data protection practices over time.

v.              Engagement of a Licensed DPCO.

Faith-based organisations should consider appointing a licensed Data Protection Compliance Organisation (DPCO) to assess and guide their compliance with the NDPA and GAID, including data protection audits, Data Privacy Impact Assessment (DPIA), staff training and appropriate policies and controls. While qualifying faith-based organisations may be exempt from registration, this does not amount to a blanket exemption from their substantive data protection obligations. Organisations should also assess whether their processing activities trigger Compliance Audit Return (CAR) obligations and seek clarification from the NDPC where the application of the registration exemption to CAR requirements is uncertain.

Conclusion

While faith-based organisations in Nigeria may benefit from a registration exemption under the GAID, this administrative relief does not absolve them of their core obligations under the NDPA. Registration exemption should not be interpreted as a waiver of accountability, and organisations remain responsible for protecting the personal data of their members, volunteers, and staff. Proactive data protection audit practices are essential, even for organisations without formal compliance structures. By documenting data processing activities, training volunteers or staff, implementing basic security controls, and maintaining an audit trail, faith-based organisations can demonstrate accountability, mitigate risks, and uphold the trust of their communities.

Just as clerical leaders safeguard the souls of their congregants, so too must they safeguard the dignity, privacy, and personal security of their data. The regulators should enforce standards fairly and consistently and must communicate clearly to the general public to shed the assumption that religious organisations are above legal scrutiny. The rule of law thrives only when it applies universally, and faith-based organisations, like all others, must be seen and must see themselves as bound by it.

Importantly, an organisation cannot rely on its registration exemption as a defence where a data breach or other violation of data protection rights occur. Affected individuals may still exercise their rights and seek appropriate remedies, including bringing claims against the organisation where their personal data has been unlawfully processed or compromised. The fact that an organisation is exempt from registration does not place it beyond the reach of the NDPA or shield it from potential liability under the privacy rights guaranteed under section 37 of the 1999

Footnotes

^{1       Idorenyin Ekpenyong, Associate, Intellectual Property and Technology Department, S.P.A. Ajibade & Co., Lagos, Nigeria.}

^{2        Nigeria Data Protection Act, 2023 (Act No. 37, Vol. 110 of the Official Gazette of the Federal Republic of Nigeria).}

^{3       General Application and Implementation Directive (NDPA GAID) 2025.}

^{4       Sections 2 and 3, NDPA, 2023.}

^{5        Section 44(6) Nigeria Data Protection Act, 2023.}

^{6  Charter of Fundamental Rights of the European Union [2012] OJ C 326/391, available at (https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:12012P/TXT accessed on 19th August 2026.}

^{7 Giovanni Buttarelli, 'Personal Data Protection in Churches and Religious Organisations' Speech to a Conference organised by the Polish Inspector for Personal Data Protection, Cardinal Stefan Wyszyński University  of  Warsaw,  Opole  University  and  the  University  of  Szczecin  available  at}

^{(https://www.edps.europa.eu/sites/default/files/publication/16-02-25_personal_data_protection_church_warsaw_en.pdf) accessed on 29th August, 2026.}

^{9       Oladiran Falor, Jidda, Obioh, ‘Why Religious Organisations Must Comply With Nigeria's Data Protection Act’ available at (https://www.mondaq.com/nigeria/data-protection/1674846/faith-and-the-law-why-religious-organisations-must-comply-with-nigerias-data-protection-act) accessed on 19th August, 2026.}

^{10      Section 2, Nigeria Data Protection Act, 2023.}

^{11  Article 8 and 10 Charter of Fundamental Rights of the European Union [2012] OJ C 326/391, available at (https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:12012P/TXT) accessed on 19th August 2026.}

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.