Privacy & Data Protection
The best-timed local play in Nigerian cyber thanks to NDPA 2023. DPO-as-a-service is real income.
What the day actually looks like.
Triage the privacy mailbox; run a 30-minute DPIA stakeholder call on a new vendor integration; update the Record of Processing Activities (RoPA); respond to a Data Subject Access Request; redraft the customer-facing privacy notice; train new hires on NDPA basics; review a Data Processing Agreement with Legal; file the quarterly NDPC Compliance Audit Return.
Where the work lives.
What you actually need.
- Reading laws (NDPA + GAID, GDPR, UK GDPR, CCPA/CPRA, Kenya DPA, POPIA)transferable
If you can read terms of service, you can read regulation.
- DPIA / TIA / LIA methodology
- OneTrust / TrustArc / Securiti
- ISO 27001 / 27701
- NIST Privacy Framework
- Plain-language writing for privacy noticestransferable
If you can write a tweet thread, you can write a privacy notice.
- Stakeholder managementtransferable
Producer's job, retitled.
- Translating regulator-speaktransferable
Same instinct as turning a brief into a script.
- Presenter confidence with execstransferable
The shape of the journey.
- 1Privacy Analyst0–2 yr
- 2Senior Privacy Analyst / DPO2–5 yr
- 3Senior DPO / Head of Privacy5–9 yr
- 4Chief Privacy Officer (CPO)9–15 yr
Note. Times reflect typical paths for someone with strong communication and 10–15 hrs/week of focused study.
What it pays.
Ranges are directional. Currency: USD · annual. Last updated: 2025.
The cert sequence that won't bankrupt you.
IAPP CIPP/E
IAPP$550 exam + $275 IAPP membership. The single most marketable privacy cert.
IAPP CIPM
IAPPPair with CIPP/E for DPO roles.
IAPP CIPT
IAPPTech track — for privacy engineers and product privacy ops.
IAPP AIGP
IAPPAI governance — fastest-growing lane.
NDPC Certified DPO
NDPCStrongest local signal in Nigeria.
OneTrust certifications
OneTrustFree, well-respected vendor cert track.
ISO 27701 LI/LA
PECBSenior-level privacy management system.
Working from Lagos, Abuja, or anywhere.
Some EU clients require EU-resident DPOs. Nigerian 'data controllers of major importance' sometimes require a local physical DPO. NDPA explicitly allows DPO via service contract — a single freelance DPO can serve 5–15 SMEs at ₦150k–₦400k/mo each.
The good, the gritty, and who this suits.
- +Genuine boom market post-NDPA 2023 — possibly the single best timing in Nigerian cyber.
- +DPO-as-a-service is a real freelance stream.
- +AI governance lane is growing fast.
- +Lawyer-adjacent without needing a law degree.
- −Source material is dry (you read laws all day).
- −Often ignored until something breaks.
- −Local DPO rules sometimes require physical presence.
If you genuinely enjoy the difference between 'consent' and 'legitimate interest', this is your seat.
Three to five hours that beat any cert.
DPO Explained
Why watch. Six-minute primer on what a DPO actually does.
Everything you Need to Know about The DPO Role
Why watch. Long-form, deeply experienced perspective.
GDPR's Requirement for a Data Protection Officer
Why watch. Where the legal requirement comes from.
What is a DPO? UK GDPR Advanced Training
Why watch. Training-style overview.
Do this by Friday.
This week: download the NDPA 2023 + GAID 2025 PDFs. Read them once. Then write a 600-word LinkedIn explainer on what they mean for a Lagos fintech founder. Tag NDPC.