IziniNDPA s.29
Vendor due diligence
A questionnaire for each supplier that handles personal data for you, with their answers scored and reviewed again later.
Product / Vendors and transfers
Your suppliers handle your data. You answer for it.
If your payroll provider or cloud host mishandles personal data, the NDPC comes to you. Izini helps you check each supplier before you sign, keep the agreement on file and assess any data that leaves Nigeria.
Check before you sign
A due diligence questionnaire for each supplier, scored and reviewed again later.
Agreements you can find
Every data processing agreement linked to the supplier and what it covers.
Transfers on record
An assessment for every flow of personal data out of Nigeria.
How it works
What your team gets
Supplier risk alongside everything else
Supplier reviews, agreements, sub-processors and transfer assessments sit in the same workspace as your records and risk register, so supplier risk is reviewed with the rest of your programme.
Also included
Everything else in vendors and transfers
NDPA s.29
Data processing agreements
Every agreement with your processors in one place, linked to the supplier and the activities it covers, with a reminder before each review.
NDPA s.29
Sub-processors
Your suppliers use suppliers too. Track the whole chain, including changes made at short notice.
NDPA s.41–43
Data sent abroad
An assessment for each transfer of personal data outside Nigeria, recording the legal basis and the safeguards in place.
For your DPO
How it maps to the law
What the NDPA asks of you in this area, and the evidence Izini keeps for each requirement.
| What the law asks | Where it comes from | What Izini keeps for you |
|---|---|---|
| Make sure your processors protect the data | NDPA s.29 | Due diligence results and the signed agreement |
| Stay responsible for the whole chain | NDPA s.29 | Sub-processors and changes to them |
| Transfer data abroad only on a lawful basis | NDPA s.41–43 | A transfer assessment for each destination |
MultiChoice Nigeria was fined ₦766 million in July 2025 after the NDPC found unlawful transfers of personal data abroad.
Related
Works together with
See where your business stands
In a 30-minute demo we look at your own website, show you what the NDPA expects of an organisation like yours, and answer your questions about setup and price.
- A walk through Izini using your own website
- A cookie scan of your site, yours to keep
- Straight answers on scope, timelines and pricing
Book a demoChat on WhatsAppWe reply within one business day.