A personal data breach is any incident leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data we hold. If one occurs:
- Contain and assess. Staff who discover or suspect a breach notify the Data Protection Focal Person (Section 6.2) immediately. We act to contain the incident and assess its scope, cause, and the categories and number of people affected.
- Notify the NDPC. Where the breach poses a risk to affected individuals' rights, we notify the Nigeria Data Protection Commission without undue delay, and in any case within 72 hours of becoming aware of it, as required by the NDPA.
- Notify affected individuals. Where the breach is likely to result in a high risk to affected individuals — which, given the population involved, includes any unauthorized disclosure of identifiable beneficiary data — we notify those individuals (or, for a minor, their parent/guardian) directly, in plain language, describing what happened, what data was involved, and what we are doing about it.
- Remediate. We take corrective action to close the vulnerability that allowed the breach and review whether the same gap could exist elsewhere in the system.
- Record. Every breach, however minor, is logged internally — what happened, our assessment, and our response — to support accountability (Section 19) and continuous improvement, even where notification thresholds were not met.