Statutory Governance • Federal Republic of Nigeria
NDPA 2023 Statutory Compliance Matrix
Statutory Alignment Overview
The Nigeria Data Protection Act 2023 (NDPA) establishes seven fundamental principles for processing personal data in Section 24. Here is how VELLO enforces each principle programmatically:
| NDPA Principle | Statutory Mandate (NDPA s.24) | VELLO Technical Implementation |
|---|---|---|
| 1. Lawfulness & Fairness | Data must be processed lawfully, fairly, and transparently. | Ingress processing relies on HOA Legitimate Interest (s.25(1)(v)) and Resident Contract performance (s.25(1)(b)). |
| 2. Purpose Limitation | Collected strictly for specified, explicit, and legitimate purposes. | Perimeter logs are used strictly for estate admission and audit; never commercialized or shared with ad networks. |
| 3. Data Minimization | Adequate, relevant, and limited to what is necessary. | Contact picker only retrieves single chosen contact. No phonebook dumping. Biometrics remain in phone enclave. |
| 4. Accuracy | Data must be accurate and kept up to date. | Resident verification workflows ensure only verified household members can generate passes. |
| 5. Storage Limitation | Retained no longer than necessary for the stated purpose. | Automated 90-Day Purge: Visitor access logs and phone numbers destroyed automatically via Celery cron jobs. |
| 6. Integrity & Confidentiality | Protected against unauthorized processing, loss, or destruction. | AES-256 cloud encryption, embedded SQLite local database offline pass signatures, TLS 1.3 in transit, and salted bcrypt credentials. |
| 7. Accountability | Data processor must demonstrate active compliance. | Comprehensive audit logging, role-based access control (RBAC), and formal B2B Controller-Processor DPA agreements. |
Regulatory Notice & DPO Inquiries
Vellum & Vector Technologies Ltd operates in active compliance with the statutory principles of the NDPA 2023. Data Processor statutory compliance records, Controller-Processor agreements, and internal governance frameworks are maintained in alignment with the Nigeria Data Protection Commission (NDPC) standards. For regulatory inquiries or Data Subject requests, reach our Data Protection Officer directly at privacy@vello.com.ng or privacy@vello.estate.