Data Protection Policy

Section 1Foreword from the Management

Section 3Introduction and Background

Bway Microfinance Bank Limited (hereinafter referred to as “the Bank”) is a licensed microfinance bank operating under the supervision of the Central Bank of Nigeria (CBN). In the ordinary course of its business, the Bank processes the personal data of a wide range of individuals, including loan applicants, deposit customers, guarantors, employees, contractors, vendors, directors, and other stakeholders.

The enactment of the Nigeria Data Protection Act, 2023 (NDPA) marked a watershed moment in Nigeria’s data protection landscape, establishing a comprehensive statutory framework that superseded several provisions of the earlier Nigeria Data Protection Regulation, 2019 (NDPR). The NDPA established the Nigeria Data Protection Commission (NDPC) as the principal regulatory authority for data protection in Nigeria, with broad powers of enforcement, investigation, and sanction.

Microfinance banks, by reason of the sensitive financial, biometric, and personal data they routinely collect and process, are classified as Data Controllers and Processors of Major Importance (DCPMI) under the NDPA and its subsidiary legislation, including the GAID 2025. This classification imposes heightened obligations including mandatory DPO designation, annual Compliance Audit Returns (CAR) filing, mandatory Data Protection Impact Assessments (DPIA), and adherence to strict data retention, security, and transfer protocols.

This policy consolidates the Bank’s obligations under all applicable data protection laws and provides a unified, practical framework for compliance across all departments, operations, branches, and subsidiaries.

Section 4Purpose and Objectives

The purpose of this policy is to:

• Establish a clear, comprehensive, and enforceable framework for the protection of personal data across all operations of the Bank.
• Ensure the Bank’s full compliance with the NDPA 2023, GAID 2025, CBN Consumer Protection Regulations, and all other applicable legislation.
• Define the rights of data subjects and the corresponding obligations of the Bank as a data controller and, where applicable, data processor.
• Prescribe the roles, responsibilities, and accountability structures for data protection governance within the Bank.
• Establish minimum standards for data collection, processing, storage, transfer, retention, and disposal.
• Provide a clear protocol for the identification, reporting, and management of personal data breaches.
• Build and sustain the trust of customers, employees, regulators, and the public through transparent and responsible data practices.
• Minimise the Bank’s legal, regulatory, reputational, and operational risks arising from data protection failures.

Section 5Scope and Application

This policy applies to:

• All employees of the Bank (full-time, part-time, contract, and temporary staff).
• All members of the Board of Directors and Board Committees.
• All consultants, agents, outsourced service providers, and third parties who process personal data on behalf of the Bank.
• All branches, business offices, digital platforms, and subsidiaries of the Bank operating within and outside Nigeria.

This policy applies to:

• All personal data processed by the Bank in both digital and physical (hard copy) formats.
• Personal data processed through the Bank’s core banking systems, mobile banking applications, USSD platforms, ATM infrastructure, digital onboarding portals, email systems, and any other information system.
• Personal data shared with or received from third parties in the course of the Bank’s business operations.

This policy applies to all processing activities conducted within Nigeria and to any processing of personal data of persons within Nigeria, regardless of where the data processor or controller is located, in accordance with Section 2 of the NDPA 2023.

Section 6Definitions and Interpretation

For the purpose of this policy, the following definitions shall apply:

Section 7Legal and Regulatory Framework

The Bank’s data protection obligations are governed by the following legal and regulatory instruments:

Section 8Data Protection Principles

The Bank is committed to ensuring that all personal data it processes is handled in accordance with the following fundamental data protection principles, as enshrined in Section 24 of the NDPA 2023:

Personal data shall be processed lawfully, fairly, and in a transparent manner in relation to the data subject. The Bank shall always have a lawful basis for processing personal data, shall not process data in a manner that is deceptive or harmful to data subjects, and shall provide clear and accessible information about its processing activities.

Personal data shall be collected for specified, explicit, and legitimate purposes and shall not be further processed in a manner incompatible with those purposes. Where the Bank seeks to use personal data for a new or different purpose, it shall obtain fresh consent or establish a new lawful basis.

Personal data collected and processed by the Bank shall be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed. The Bank shall not collect more data than is required for a given purpose.

Personal data shall be accurate and, where necessary, kept up to date. The Bank shall take all reasonable steps to ensure that inaccurate personal data is erased or rectified without delay. Data subjects are encouraged to notify the Bank of any changes to their personal information.

Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed. The Bank’s retention schedule (Section 15) defines the applicable retention periods for each category of data.

Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures.

The Bank, as data controller, shall be responsible for and be able to demonstrate compliance with the foregoing principles. The Board of Directors bears ultimate accountability for the Bank’s data protection compliance, with day-to-day responsibility delegated to the Data Protection Officer.

Section 9Categories of Personal Data Processed

The Bank processes the following categories of personal data in the course of its operations:

• Full legal name, date of birth, nationality, gender.
• BVN (Bank Verification Number), NIN (National Identity Number).
• Residential and business addresses.
• Phone numbers, email addresses.
• Biometric data (fingerprints, facial images) for KYC and authentication.
• Financial data: income, employment details, transaction history, account balances.
• Loan application data, credit history, repayment records.
• Guarantor information and relationship data.
• Next-of-kin information.
• Utility bills, tax identification numbers, and other identity verification documents.

• Personal and contact information, emergency contacts.
• Educational and professional qualifications.
• Employment history, performance records, disciplinary records.
• Payroll and salary information, bank account details.
• Tax and pension information.
• Health and medical data (where relevant to employment).
• Biometric data used for access control and time management.

• Contact details of representatives of vendors, suppliers, and service providers.
• KYC documentation required for vendor onboarding.
• Contract and correspondence records.

• IP addresses, device identifiers, browser and session data.
• USSD session data, mobile banking login records.
• CCTV footage from Bank premises.
• Call recordings where applicable.

Section 10Lawful Bases for Processing

The Bank shall process personal data only where one of the following lawful bases under Section 25 of the NDPA 2023 applies:

Section 11Sensitive / Special Category Data

The following categories of data are classified as sensitive personal data under Section 30 of the NDPA 2023 and attract heightened protection:

• Biometric data (fingerprints, facial recognition data).
• Health and medical data.
• Financial data beyond basic account identifiers.
• Racial or ethnic origin.
• Religious or philosophical beliefs.
• Political opinions.
• Trade union membership.
• Genetic data.
• Data concerning sex life or sexual orientation.

The Bank shall only process sensitive personal data where:

• The data subject has given explicit consent for one or more specified purposes.
• Processing is necessary for carrying out obligations or exercising rights in employment and social protection law.
• Processing is necessary to protect the vital interests of the data subject.
• Processing relates to personal data manifestly made public by the data subject.
• Processing is necessary for compliance with applicable laws and regulations including AML/CFT obligations.

Where the Bank processes sensitive personal data, it shall apply the following additional safeguards:

• Maintain a separate register of all sensitive data processing activities.
• Conduct a DPIA prior to commencing any new sensitive data processing activity.
• Apply enhanced access controls and encryption to sensitive data repositories.
• Restrict access to sensitive data to only those personnel with a demonstrable need.

Section 12Data Subject Rights

The Bank fully recognises and shall facilitate the exercise of the following rights by data subjects under the NDPA 2023:

Data subjects have the right to obtain confirmation of whether the Bank is processing their personal data and, if so, to receive a copy of that data along with supplementary information about the processing. The Bank shall respond to access requests within 72 hours of receipt and provide the requested information within 30 days.

Data subjects have the right to request the correction of inaccurate personal data and the completion of incomplete data. The Bank shall action rectification requests without undue delay and within 30 days of receipt.

Data subjects may request the deletion of their personal data where: the data is no longer necessary for the purpose collected; consent has been withdrawn; the data has been unlawfully processed; or erasure is required by law. The Bank shall respond within 30 days. Note that erasure may not apply where retention is required by law (e.g. AML/CFT records).

Data subjects may request restriction of processing in circumstances where the accuracy of data is contested, the processing is unlawful, or the Bank no longer needs the data but the data subject requires it for legal claims.

Where processing is based on consent or contract, data subjects have the right to receive their personal data in a structured, commonly used, machine-readable format, and to transmit that data to another controller.

Data subjects have the right to object to the processing of their personal data where processing is based on legitimate interests or public interest, and in all cases where data is used for direct marketing purposes.

Data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects. Where automated decision-making is used (e.g. for credit scoring), the Bank shall offer a mechanism for human review.

Where processing is based on consent, data subjects may withdraw consent at any time without detriment. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

Section 13Consent Management Framework

Where the Bank relies on consent as the lawful basis for processing, the consent obtained must meet the following standards:

• Freely given: The data subject must not be subject to any detriment for withholding consent. Consent shall not be bundled as a condition for accessing the Bank’s services where processing is not necessary for that service.
• Specific: Consent must be sought for specific, clearly defined processing purposes.
• Informed: The data subject must be provided with sufficient information to understand what they are consenting to.
• Unambiguous: Consent must be evidenced by a clear affirmative action. Pre-ticked boxes or inactivity shall not constitute valid consent.
• Withdrawable: Data subjects must be informed of their right to withdraw consent and provided with an easy mechanism to do so.

The Bank shall maintain records of all consents obtained, including the date and time of consent, the information provided to the data subject at the time of consent, and the mechanism used to obtain consent. These records shall be retained for the duration of the processing activity plus five (5) years.

Where the Bank provides services to individuals below the age of 18, consent shall be obtained from the parent or legal guardian of such individual. The Bank shall implement reasonable measures to verify the age of data subjects and the authority of persons providing consent on their behalf.

Section 14Data Collection and Use

The Bank shall collect personal data only:

• Directly from the data subject wherever possible.
• Through fair and lawful means.
• For specified, explicit, and legitimate purposes that are communicated to the data subject at the time of collection.
• To the minimum extent necessary to achieve the stated purpose.

The Bank shall provide a clear, concise, and accessible Privacy Notice to all data subjects at or before the point of data collection. The Privacy Notice shall contain:

• The identity and contact details of the Bank as data controller.
• The contact details of the DPO.
• The purposes and lawful bases for processing.
• The categories of personal data collected.
• The recipients or categories of recipients of personal data.
• Details of any cross-border transfers and the safeguards in place.
• The retention period or the criteria used to determine it.
• A description of the data subject’s rights and how to exercise them.
• The right to withdraw consent and how to do so.
• The right to lodge a complaint with the NDPC.

Where the Bank intends to use personal data collected for a primary purpose for a secondary or additional purpose, it shall assess the compatibility of the new purpose with the original purpose, considering the link between the purposes, the nature of the data, and the potential consequences for data subjects. Where the new use is incompatible, the Bank shall obtain fresh consent or establish a new lawful basis.

Section 15Data Retention and Disposal

The Bank shall retain personal data for no longer than is necessary for the purpose for which it was collected, subject to overriding legal obligations requiring longer retention periods.

Upon expiry of the applicable retention period, personal data shall be disposed of securely using the following methods:

• Electronic data: Secure deletion using NIST-approved data wiping standards, or physical destruction of storage media.
• Physical records: Cross-cut shredding by approved destruction service providers, with a certificate of destruction retained.
• Backups: Inclusion of expired data in the next scheduled secure backup deletion cycle.

Section 16Data Security and Technical Safeguards

The Bank shall implement and maintain a robust information security management framework proportionate to the risks posed by its data processing activities. The Chief Information Security Officer (CISO) or equivalent officer shall be responsible for the implementation of technical and organisational security measures.

The Bank shall implement the following technical security measures at minimum:

• End-to-end encryption of sensitive data in transit using TLS 1.2 or higher.
• Encryption of sensitive data at rest using AES-256 or equivalent standard.
• Multi-factor authentication (MFA) for all access to core banking systems and critical infrastructure.
• Role-based access control (RBAC) to restrict access to personal data to authorised personnel only.
• Regular penetration testing and vulnerability assessments of all digital systems.
• Intrusion detection and prevention systems (IDS/IPS).
• Regular application of security patches and software updates.
• Secure coding standards for all internally developed applications.
• Database activity monitoring and real-time alerting for suspicious access patterns.
• Comprehensive audit logging of all access to, and processing of, personal data.
• Regular data backup with tested recovery procedures.

• All staff to complete mandatory data protection training before accessing personal data.
• Non-disclosure and confidentiality agreements for all staff and third parties with data access.
• Clear desk and screen lock policies in all offices.
• Physical access controls to data processing areas.
• Secure visitor management procedures.
• Segregation of duties to prevent unauthorised access to sensitive data.
• Annual security risk assessments reviewed by the Board Risk Committee.

Section 17Data Breach Management and Response

A personal data breach is any security incident that results in accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This includes but is not limited to cyberattacks, internal theft, accidental disclosure, lost devices, and system misconfigurations.

The Bank shall follow the following response steps upon identification of a data breach:

• 1Containment: Immediately isolate affected systems and limit further exposure. The IT Security team shall take immediate technical remediation steps.
• 2Assessment: The DPO and IT Security shall assess the nature, scope, and likely impact of the breach within twenty-four (24) hours of discovery.
• 3Notification to NDPC: Where the breach is likely to result in a risk to the rights and freedoms of data subjects, the Bank shall notify the NDPC without undue delay and within seventy-two (72) hours of becoming aware of the breach, in accordance with Section 40 of the NDPA 2023.
• 4Notification to Data Subjects: Where the breach is likely to result in a high risk to the rights and freedoms of data subjects, the Bank shall also notify affected data subjects without undue delay.
• 5Documentation: The Bank shall document all data breaches in the Breach Register, regardless of whether they are notifiable, including the facts of the breach, its effects, and the remedial actions taken.
• 6Post-Breach Review: Following resolution, the DPO shall conduct a root cause analysis and implement measures to prevent recurrence.

The DPO shall maintain a Breach Register containing details of all data security incidents, whether or not they reach the threshold of a notifiable breach. The Breach Register shall be made available to the NDPC upon request.

Section 18Third-Party and Vendor Management

The Bank shall not share personal data with any third party that will process such data on its behalf unless a Data Processing Agreement (DPA) compliant with Schedule 2 of the NDPA 2023 has been executed. The DPA shall specify:

• The subject matter, duration, nature, and purpose of the processing.
• The type of personal data involved and the categories of data subjects.
• The obligations and rights of the Bank as data controller.
• The processor’s obligation to process data only on documented instructions from the Bank.
• Security measures the processor must implement.
• Obligations regarding sub-processors.
• Cooperation with NDPC investigations.
• Deletion or return of data at end of contract.

Prior to engaging any vendor who will process personal data, the Bank’s Procurement and DPO functions shall conduct data protection due diligence including:

• Assessment of the vendor’s data protection policies and certifications.
• Review of the vendor’s security infrastructure and data handling procedures.
• Verification of the vendor’s compliance with applicable Nigerian data protection laws.
• Ongoing monitoring and periodic audit rights.

Vendors shall not be permitted to engage sub-processors to handle the Bank’s personal data without the Bank’s prior written consent. The Bank shall maintain a register of all approved sub-processors.

Section 19Cross-Border Data Transfers

The Bank shall not transfer personal data outside Nigeria except where one of the following conditions is met, in accordance with Section 43 of the NDPA 2023:

• The NDPC has issued an adequacy decision in respect of the receiving country.
• Appropriate safeguards have been put in place, such as standard contractual clauses approved by the NDPC, binding corporate rules, or approved codes of conduct.
• The data subject has given explicit, informed consent to the transfer.
• The transfer is necessary for the performance of a contract between the data subject and the Bank, or for pre-contractual measures.
• The transfer is necessary for important reasons of public interest.
• The transfer is necessary for the establishment, exercise, or defence of legal claims.

All cross-border transfers shall be documented by the DPO, and appropriate transfer mechanisms shall be reviewed annually to ensure continued adequacy.

Section 20Privacy by Design and Default

The Bank is committed to embedding data protection into the design and architecture of all new products, services, systems, and processing activities, rather than treating it as an afterthought. In accordance with Section 36 of the NDPA 2023 and the principle of Privacy by Design:

• Data protection requirements shall be considered at the earliest stage of any new product development, technology implementation, or business process redesign.
• Only the minimum data necessary for the stated purpose shall be collected and processed (data minimisation by default).
• Personal data shall not be made accessible to more individuals than is necessary for the stated purpose (access restriction by default).
• New systems shall be built with technical safeguards such as pseudonymisation and encryption embedded from the outset.
• The DPO shall be consulted during the design phase of any new processing activity.
• Privacy by Design review shall form part of the Bank’s project management methodology.

Section 21Data Protection Impact Assessment (DPIA)

The Bank shall conduct a DPIA prior to commencing any processing activity that is likely to result in a high risk to the rights and freedoms of data subjects. A DPIA is mandatory in the following circumstances:

• Large-scale processing of sensitive personal data.
• Systematic and extensive evaluation of individuals based on automated processing, including profiling.
• Systematic monitoring of a publicly accessible area on a large scale (e.g. CCTV systems).
• Introduction of new technology with significant data protection implications.
• Transfer of personal data to a third country for the first time.
• Any processing activity that the NDPC has determined requires a DPIA.

A DPIA shall: systematically describe the processing activity and its purpose; assess the necessity and proportionality of the processing relative to its purpose; identify and assess the risks to the rights and freedoms of data subjects; identify measures to address those risks and reduce them to an acceptable level; be documented and retained by the DPO; and be reviewed and updated if the nature of the processing changes.

Where a DPIA indicates a high residual risk that cannot be mitigated, the Bank shall consult with the NDPC prior to commencing the processing activity, in accordance with Section 38 of the NDPA 2023.

Section 22Roles and Responsibilities

Section 23Data Protection Officer (DPO)

As a DCPMI, the Bank is required by Section 32 of the NDPA 2023 and the GAID 2025 to designate a Data Protection Officer. The DPO shall be formally designated by the Board and registered with the NDPC. The DPO’s details shall be published on the Bank’s website and communicated to all staff and customers.

The DPO shall possess: expert knowledge of data protection law and practices, particularly the NDPA 2023, NDPR, and GAID 2025; a recognised data protection certification (e.g. NDPR Compliance Certificate from an NITDA-accredited body, CIPP/A, or equivalent); understanding of the financial services regulatory environment; and the ability to act independently and objectively.

The DPO shall perform their functions with independence and shall not receive instructions regarding the exercise of those tasks. The DPO shall report directly to the highest level of management. The Bank shall not penalise or dismiss the DPO for performing their duties.

The DPO’s primary functions shall include:

• Informing and advising the Bank and its staff of their data protection obligations.
• Monitoring compliance with the NDPA, NDPR, and this policy.
• Maintaining the Record of Processing Activities (ROPA).
• Conducting and overseeing DPIAs.
• Acting as the primary point of contact with the NDPC.
• Handling data subject rights requests and complaints.
• Coordinating the annual Compliance Audit Return (CAR) filing.
• Providing data protection training to all staff.
• Advising on data processing agreements.

Section 24Training and Awareness

All staff shall complete mandatory data protection training as follows:

• Induction Training: All new staff shall complete a data protection induction module within their first two weeks of employment, before being granted access to personal data systems.
• Annual Refresher Training: All staff shall complete an annual data protection refresher training module.
• Role-Specific Training: Staff in high-risk roles (DPO, IT, Compliance, Legal, Customer Service) shall complete advanced role-specific training annually.
• Breach Response Training: The incident response team shall participate in a simulated breach exercise at least once annually.

The DPO shall maintain records of all training completed by each member of staff. Failure to complete mandatory training shall be reported to the relevant line manager and escalated to HR for disciplinary action where necessary.

The DPO shall implement ongoing data protection awareness initiatives including: regular internal communications on data protection topics; Data Protection Day observance on 28 January each year; and periodic reminders of staff obligations following any significant regulatory development.

Section 25Audit, Monitoring and Review

The Bank’s Internal Audit function shall include data protection compliance as a standing component of its annual audit plan. The audit shall assess: adherence to this policy and applicable laws; adequacy of technical and organisational security measures; completeness and accuracy of the ROPA; effectiveness of data subject rights handling procedures; adequacy of third-party data processing agreements; and training completion rates and effectiveness.

In accordance with the NDPA 2023 and the GAID 2025, the Bank shall engage a licensed Data Protection Compliance Organisation (DPCO) to conduct an annual data protection audit and prepare the Compliance Audit Return (CAR). The DPCO shall be licensed by the NDPC.

This policy shall be reviewed at least annually by the DPO in consultation with the Legal, Compliance, and IT teams. Ad hoc reviews shall be conducted following: any significant change in applicable law or regulation; a material data breach; significant organisational change; or identification of gaps through audit findings.

Section 26Complaints and Escalation Procedure

Any data subject who wishes to raise a complaint about the Bank’s data protection practices shall submit their complaint in writing to:

Section 27Policy Governance and Review

This policy is owned by the Data Protection Officer and approved by the Board of Directors. It shall be reviewed at minimum annually and updated as required to reflect changes in law, regulation, or the Bank’s operations. All updates shall be approved by the Board or, in the case of minor administrative amendments, by the Managing Director, and communicated to all staff.

This policy supersedes all previous data protection policies, guidelines, and procedures of the Bank. In the event of any conflict between this policy and a department-specific procedure, this policy shall prevail.