Data Retention and Deletion in Nigeria: How to Keep, Archive and Delete Customer Data

Data retention in Nigeria is governed by two sets of rules that pull in opposite directions. The Nigeria Data Protection Act 2023 says delete customer data once its purpose is finished. Anti-money laundering law says keep it for five years. Both apply to the same records, and knowing which one wins is the whole job.

Most compliance teams discover the conflict the hard way. A customer asks for their data to be deleted, the request lands with the data protection officer, and nobody can say whether the bank is allowed to say no. This guide sets out what the law actually requires, how long each record type must be held, and how to build a retention schedule that satisfies the Nigeria Data Protection Commission and the anti-money laundering supervisor at the same time.

Which Laws Set Data Retention Requirements in Nigeria?

There are 4 data protection laws in Nigeria that decide how long a Nigerian financial institution keeps customer data, and they were written by three different regulators who did not coordinate.

The Nigeria Data Protection Commission owns the privacy side. The Nigeria Data Protection Act 2023, signed on 12 June 2023, sets the principles. Section 24(1) requires that personal data be adequate, relevant and limited to what the purpose needs, which is where storage limitation comes from. Section 34 gives data subjects the right to erasure. Section 48(2) sets the penalties.

The Commission then issued the General Application and Implementation Directive on 20 March 2025, which took effect on 19 September 2025. The Directive, known as GAID 2025, is where the operational detail sits. It is the document that turns "limit storage" into actual deadlines.

The Money Laundering (Prevention and Prohibition) Act 2022 pulls the other way. Section 8 requires five-year retention of transaction records and customer due diligence files. The Money Laundering Act 2022 obligations apply to every financial institution and virtual asset service provider in the country.

The Central Bank of Nigeria adds a fourth layer, and it is about location rather than duration. A circular issued on 15 June 2026 introduced data localisation for the payments system, with a compliance date of 1 January 2027.

What are the Data Retention Periods in Nigeria for Each Customer Record Type?

The data retention periods in Nigeria run from six months to five years depending on the record: five years for customer due diligence files, transaction records and regulatory reports, and six months for abandoned applications or any data with no statutory duty attached. There is no single period, because the duty attaches to the record and not to the customer.

Read the table as a floor, not a ceiling. Five years is the minimum under anti-money laundering law. It is not permission to keep the file forever, which is the mistake most institutions are actually making.

Does the five-year clock restart?

No. The clock runs from a fixed event, and the event differs by record. 

For a transaction record, it starts when the transaction completes. 

For the customer file, it starts when the relationship ends, which means a dormant account that has never been formally closed has no start date at all. Dormancy is not closure, and plenty of five-year clocks across the Nigerian banking sector have simply never begun to run.

What Does the Nigerian Data Protection Act Say About Deleting Customer Data?

Section 34 of the Nigeria Data Protection Act gives a data subject the right to erasure. GAID 2025 spells out when that right bites and when it does not.

Article 38(1) lists the grounds. A customer can demand deletion where the data is no longer necessary for the purpose it was collected for, where consent has been withdrawn and no other lawful basis applies, or where the processing was unlawful in the first place.

Article 38(2) lists the exceptions, and this is the provision a compliance team needs at hand. Erasure can be refused where the data is needed to establish, exercise or defend a legal claim, or where another public interest ground applies. A statutory anti-money laundering duty sits squarely in that carve-out.

Article 38(3) adds a duty most institutions miss. Where erasure is granted, the controller must make sure third parties who received the data delete it too. That means every vendor, outsourced call centre and analytics provider in the chain, which is only possible if you know where the data went.

What is the six-month deletion rule?

Article 49 of GAID 2025 sets a hard backstop. Where no time-bound obligation applies to the data, storage must end no later than six calendar months after the original purpose has been accomplished. Article 49(4) permits longer storage to defend a legal claim or for due diligence, provided appropriate technical and organisational measures are in place.

The phrase "where no time-bound obligation applies" is doing a lot of work. It is the hinge the whole retention schedule turns on.

Why Do Data Retention Rules in Nigeria Conflict with AML Record Keeping

Data retention rules in Nigeria conflict because two statutes set different clocks on the same customer file. GAID 2025 says six months. The Money Laundering (Prevention and Prohibition) Act 2022 says five years.

The resolution is not that one law beats the other. It is that the six-month rule only applies to data with no competing statutory duty attached. Where anti-money laundering law imposes a five-year duty, that duty is the time-bound obligation, and it governs.

What this means in practice is that you cannot run data retention in Nigeria as a single rule. You run it record by record, with a documented basis for each period.

Why "keep everything, just in case" fails both tests.

Keeping everything indefinitely feels like the safe option to an anti-money laundering officer. It is not. It breaches section 24 of the NDPA, which limits storage to what the purpose requires, and it was a factor in the largest data protection penalty the Commission has issued to date.

It also raises your breach exposure. Every record you hold past its retention period is a record that can be stolen, and the Commission must be notified of a personal data breach within 72 hours under Article 33(1) of GAID 2025.

What Are the Data Retention Rules in Nigeria for Failed KYC Applications?

The data retention rules in Nigeria give a failed or abandoned KYC application six months. Article 21(2) of GAID 2025 says that personal data gathered at a pre-contract due diligence stage, where no contract followed, must be destroyed within six months. The exception is data justifiably archived for a future legal claim.

This is the gap almost nobody has closed, and it sits in the middle of the verification stack.

Read that against a typical Nigerian onboarding funnel. For every account that opens, several applicants abandon the flow halfway, fail verification, or are declined. Their tiered KYC submissions are still sitting in the system: Bank Verification Number, National Identification Number, a selfie, a utility bill, a government identity document.

Those records now carry a six-month destruction deadline, and no anti-money laundering duty protects them, because no business relationship ever existed. Most institutions have never deleted a single one.

What should you archive instead?

You do need to be able to show why you declined someone, particularly where the decision followed a sanctions or adverse media hit. The answer is to archive the decision, not the dossier.

• Keep the outcome, the date, the reason code and the identifier of the officer or rule that made the call.
• Keep the screening match that triggered the decision, since that is the defensible core of a future legal claim.
• Destroy the underlying identity documents, biometric captures and address evidence once the six months expire.
• Record the destruction, because an undocumented deletion looks identical to a lost file during an audit.
•  

Where Must Customer Data Be Stored Under Nigeria Data Localization Rules?

Payment transaction data generated in Nigeria must be stored and managed on infrastructure inside Nigeria, under data localisation rules that bite on 1 January 2027. Retention is not only about how long. Since June 2026 it is also about where.

The CBN circular of 15 June 2026, titled "Introduction of Market Structure Requirements, Data Localisation, Ultimate Beneficial Ownership Disclosure, and Systemic Oversight Measures in the Nigeria Payments System", requires payment transaction data generated within Nigeria to be stored and managed in Nigeria. The deadline is 1 January 2027.

Two words in that requirement matter more than the rest. "Managed" extends the duty past storage into access management, database administration, key management and audit logging. And because the rule attaches to data generated in Nigeria rather than to where the business is registered, a foreign-domiciled processor handling Nigerian payment flows is caught too.

The NDPA handles the privacy side of the same question. Section 41 permits cross-border transfer only in defined circumstances, section 41(2) requires you to record the basis for each transfer, and section 42 sets the adequacy test. Article 45 of GAID 2025 points back to Part VIII of the Act for the governing rules.

For a compliance team, the practical question is simple. Can you produce a current list of every system, backup and vendor that holds Nigerian customer data, and the country each one sits in? If not, you cannot evidence either rule.

How Do You Handle a Deletion Request From a Customer?

Answering a right to erasure request in Nigeria takes seven steps: log and verify the requester, find every copy, classify each against the anti-money laundering duty, delete what is not covered, refuse the rest in writing, push the deletion downstream, and keep the audit trail.

It is a timed process, not a conversation. GAID 2025 sets the clock for complaints that reach the Commission: acknowledgement within seven days, a respondent reply within twenty-one days, and the decision communicated within seven days under Article 39.

1. Log the request and verify who is asking. Acting on an unverified deletion request is itself a data protection failure.

2. Find every copy. Core banking, the verification provider, the monitoring system, the data warehouse, the call recordings, the email archive.

3. Classify each copy. Is it covered by a five-year anti-money laundering duty, or not?

4. Delete what is not covered. Marketing lists, analytics profiles, abandoned applications, duplicate scans.

5. Refuse the rest in writing. Name the exception in Article 38(2), name the statutory duty, and give the date the hold expires.

6. Push the deletion downstream. Article 38(3) makes third-party erasure your responsibility.

7. Keep the audit trail. What you deleted, what you kept, why, and when the retained part becomes deletable.

The step 6 is where most programmes break. If you cannot instruct a vendor to delete a record and get confirmation back, you are not compliant no matter how clean your own database is. 

1.  

   What Are the Penalties for Breaching Data Retention Rules in Nigeria?

    

   The penalties for breaching data retention rules in Nigeria reach the higher of ₦10 million or 2% of the previous year's annual gross revenue. The Commission has moved from guidance to enforcement, and the numbers are no longer theoretical.

    

In January 2026 the National Commissioner, Vincent Olatunji, reported that the Commission had concluded 246 investigations, taken 11 enforcement actions, and generated over ₦5.2 billion in compliance revenue. By that point 38,677 data controllers and processors of major importance had registered and more than 8,155 Compliance Audit Returns had been filed.

Financial services is not a bystander in that programme. In August 2025 the Commission sent compliance notices to 1,348 entities across banking, insurance, pension and gaming.

NDPC Enforcement Cases: Fidelity Bank and MultiChoice

In August 2024 the Commission fined Fidelity Bank ₦555.8 million for processing customer data without informed consent, a figure representing roughly 0.1% of the bank's 2023 annual gross revenue. The Commission noted that the penalty was increased because of the bank's lack of cooperation during the investigation, which had been running since April 2023.

In July 2025 it fined MultiChoice Nigeria ₦766.2 million over its data practices, including unlawful cross-border transfers of personal data.

The pattern across both decisions is instructive. Neither penalty was driven by a hacking incident. Both came from how the organisation handled data it had collected legitimately, which is exactly the territory a retention schedule governs.

How to Build a Data Retention Schedule for a Nigerian Financial Institution

Building a data retention schedule for a Nigerian financial institution takes five steps: inventory by purpose, attach the statutory duty to each category, define the trigger event, automate the deletion and log it, then file the registration and returns the Directive requires. The schedule itself is a table stating, for every category of personal data you hold, how long you keep it, why, where it lives and what happens at the end.

Step one: Inventory by purpose, not by system

List the purposes you process data for. Account opening. Ongoing customer due diligence. Transaction monitoring. Dispute resolution. Marketing. Credit assessment. Each purpose has its own lawful basis and therefore its own retention period.

Step two: Attach the statutory duty to each category

For each category, record whether a time-bound obligation applies and cite it. Section 8 of the MLPPA for anti-money laundering records. Nothing at all for marketing preferences, which means Article 49 applies and the period is six months after the purpose ends.

Step three: Define the trigger event, what start the clock.

A period with no start date is useless. Write down the event that starts the clock for each category, and make sure a system actually records that event. If nothing in your core banking platform marks the end of a business relationship, the five-year clock cannot be measured.

Step four: Automate the deletion, then log it

Manual deletion does not survive contact with a real institution. The schedule needs to run as a job, with a report that shows what was deleted and what was held back under a legal hold. That report is the evidence you hand an auditor.

Step five: File the paperwork the Directive requires

Commercial banks operating at national or regional level are classified at the Ultra-High Level tier for registration purposes, and microfinance banks at the Extra-High Level. Both register once and then file Compliance Audit Returns annually by 31 March, through a licensed Data Protection Compliance Organisation under Article 10(14). A Data Protection Impact Assessment must be completed and submitted before new processing begins under Article 28(9).

Meeting Data Retention Requirements in Nigeria With Youverify

The hard part of data retention is not writing the policy. It is knowing, at any moment, exactly what customer data you hold, where it came from, which purpose justifies it, and when it becomes deletable. That is a data lineage problem sitting inside a verification stack.

A verification platform that helps rather than hinders retention compliance does four things. It records the purpose and lawful basis at the point of capture, not retrospectively. It distinguishes a completed onboarding from an abandoned one, so Article 21(2) can be applied automatically. It keeps a tamper-evident audit trail of every check, which is what defends a decision years later. And it supports deletion as a first-class operation, including across the vendor chain.

Youverify runs KYC and AML compliance on exactly that model. Identity verification, document checks, biometrics, address verification, PEP and sanctions screening and transaction monitoring sit on one platform with a single audit trail, so the record of why a decision was made is held separately from the raw identity documents that justified it. That separation is what lets you destroy an applicant's documents at six months while keeping a defensible record of the rejection.

Deployment matters here too. With the CBN data localisation deadline of 1 January 2027 approaching, where your verification provider stores and manages Nigerian customer data stops being an IT detail and becomes a licence condition.

Book a demo with our compliance experts to see how Youverify handles retention, deletion and audit evidence across the customer lifecycle.