Compliance
Where Breno stands against the Nigeria Data Protection Act 2023 and the NDPR, requirement by requirement, with what is done, what is partial and what is still open. No certification is claimed.
The rules in short#
- Nigeria Data Protection Act 2023 (NDPA) is the governing statute. It sets the principles of processing, the lawful bases, the rights of data subjects, the duties of controllers and processors, cross-border transfer conditions, and the Nigeria Data Protection Commission (NDPC), which enforces it.
- The Nigeria Data Protection Regulation 2019 (NDPR) and its Implementation Framework were the earlier regime. As we understand it, the NDPA and the Commission's General Application and Implementation Directive (GAID) 2025 now carry most of what they required, and the NDPR continues only to the extent it is consistent. Confirm the current position with counsel. The notices are written to the NDPA and to the principles the NDPR set.
Requirement by requirement#
| Requirement | What Breno does | Status |
|---|---|---|
| Identify the controller and give contact details | The privacy notice says who is the controller for a hosted instance and for a self-run one, and gives the office address and contact@breno.ng. The registered entity's name is not yet filled in. | Partial |
| A Data Protection Officer, where required | A visible placeholder in the notice. Whether one is required and who it is are decisions for the operator. | Open |
| A lawful basis for each purpose, stated | A table in the notice pairs each activity with its basis. | Done, pending legal review |
| A notice that is conspicuous, plain, and reachable | /privacy, /terms and /cookies are linked from every page's footer, the sign-up and sign-in pages, the cookie notice and these docs, and are in the sitemap. | Done |
| Valid consent, withdrawable, where relied on | Only strictly necessary cookies are set, so no consent is needed for them; the choice is recorded and can be changed. Consent withdrawal is described in the notice. | Done |
| Data subject rights: be informed, access, correct, erase, restrict, object, portability, withdraw consent, no solely automated decisions | Export and deletion are self-service; administrators have per-member export and erasure; the rest by request within 30 days. See Data subject requests. | Done; the request process outside self-service is manual |
| Data minimization and purpose limitation | The site sets four cookies and runs no analytics; content is used only to provide the service. | Done |
| Retention limits | Defined windows (trash 30 days, sync history 30 days, finished sync jobs 90 days), a legal hold. | Partial: retention does not yet apply to knowledge items in trash under hold |
| Security of processing | Database-enforced isolation, one access rule, encryption of secrets, two-factor authentication, an append-only audit log, tested. See Security overview. | Done, with the gaps on Known limits |
| Breach notification to the NDPC within 72 hours, and to affected people where risk is high | Stated in the notice. Monitoring and alert runbooks exist. A written breach-response procedure is drafted (docs/compliance/breach-response-procedure.md); the people who fill its roles are not yet named. | Partial |
| Cross-border transfers only with adequacy or safeguards | The notice explains it, and that the model provider and connected sources are the operator's choice. The hosting region is not yet filled in. | Partial |
| Children's data | The product is for workplaces and the notice says it is not for anyone under 18. | Done |
| Data protection impact assessment, where processing is high risk | Drafted (docs/compliance/dpia.md); its residual risks are not yet accepted by the owner. | Partial |
| A record of processing activities | Drafted from the code (docs/compliance/record-of-processing.md); the owner has not yet confirmed it or filled in the region and retention fields. | Partial |
| Registration with the NDPC and annual compliance filings, if the operator is a controller of major importance | Not yet done. Whether the operator is of major importance depends on the Commission's classification. | Open |
| Review by Nigerian counsel | Not done. | Open |
International frameworks#
Breno also keeps a control mapping to GDPR articles (access, erasure, minimization, security, records) and to the SOC 2 Trust Service Criteria, with pointers to the code and tests that implement each. It is evidence for an audit, not an audit or a certification. Known gaps: encryption at rest depends on how the database is configured and is not enforced by Breno's code; a SOC 2 Type II needs an observation period of collected evidence; HIPAA is out of scope until a business associate agreement and a review of health-data handling exist.
Contacts#
- Privacy questions and requests: contact@breno.ng
- Complaints to the regulator: the Nigeria Data Protection Commission, ndpc.gov.ng
- Security reports: Report a vulnerability