These terms are used throughout this policy as defined below, consistent with their use in the Nigeria Data Protection Act 2023 ("the Act" or "NDPA").
Term
Meaning
Personal data
Any information relating to an identified or identifiable individual — directly (e.g., a name) or indirectly (e.g., a combination of community, cohort, and outcome details that could identify someone).
Sensitive personal data
A special category of personal data requiring extra protection: health data, biometric or genetic data used for identification, race or ethnicity, religious or political beliefs, trade union membership, sexual orientation, and similar categories the NDPC may designate. The Academy does not intentionally collect sensitive personal data (see Section 7).
Data subject
The individual the personal data is about — a beneficiary, donor, staff member, volunteer, or website visitor.
Processing
Anything done with personal data: collecting, recording, storing, using, disclosing, combining, or deleting it.
Data controller
The organization that decides why and how personal data is processed. Eifen & Eighth Academy is the data controller for the data described in this policy.
Data processor
A third party that processes personal data on the Academy's behalf and under its instructions (e.g., a hosting provider).
Consent
A freely given, specific, informed, and unambiguous indication of a data subject's wishes, given by a clear affirmative act, by which they agree to processing of their personal data for a stated purpose. Silence, pre-ticked boxes, or inactivity are not consent.
Child
A person under the age of 18, consistent with the Child Rights Act 2003. Processing a child's personal data requires parental or guardian consent under the NDPA.
Data Protection Officer (DPO)
A designated individual responsible for overseeing an organization's data protection obligations, mandatory for data controllers or processors “of major importance” under the NDPA (see Section 6).
Cross-border transfer
Sending or making personal data accessible outside Nigeria, including storing it on servers located abroad.
Data breach
Any incident leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data.
Nigeria Data Protection Commission (NDPC)
The regulator established under the NDPA to enforce Nigerian data protection law.
Anonymization / Aggregation
Processing data so that no individual can reasonably be identified from it, e.g., showing a count of “8 beneficiaries employed” rather than naming them.