Imagine someone visits your business website and submits an enquiry.
They provide their full name, email address, phone number, and a short description of what they need. A few minutes later, your business receives the notification, and someone responds.
The conversation continues. You send a quotation, agree on the price, and eventually complete the transaction.
From your perspective, this is an ordinary business interaction.
But consider everything that happened behind the scenes.
The customer's information was entered into a website form, transmitted through the internet, processed by your website application, and stored somewhere. Depending on your setup, it may also have been sent to your business email account, recorded in a customer management system, or shared with another service.
Who can access that information?
How long will you keep it?
What happens if your website is compromised?
And if the customer asks you to correct or delete their information, do you know where to find it?
These questions are important because collecting customer information is not just a technical function. It comes with responsibilities.
Many Nigerian businesses have websites with contact forms, customer accounts, newsletter subscriptions, and online payment facilities. Yet some business owners rarely consider what happens to the information collected through these features.
A website can look professional, attract customers, and generate sales while still having weaknesses in how it handles personal information.
If your website collects information about people, you need to understand what you collect, why you collect it, where it goes, and how you protect it.
This is not only about avoiding security problems. It is also about building a business that customers can trust.
When people hear the phrase customer data, they often think about bank details, passwords, or financial records.
But personal information can be much simpler.
A person's name, email address, phone number, residential address, and other information that identifies or relates to them can qualify as personal data.
Your website may collect this information through several features.
A contact form collects information when someone requests a quotation.
A newsletter form collects an email address when someone subscribes to updates.
An online store collects customer details to process orders and arrange delivery.
A membership website may collect account information and records of user activity.
An appointment booking system may collect names, contact details, preferred dates, and other information needed to arrange a service.
Even website analytics and tracking tools may process information about visitors, depending on the technologies used and how they are configured.
The important point is that personal data collection is not limited to large companies or financial institutions.
A small business with a five-page WordPress website can still process personal information.
And once that information enters your systems, you need to understand how it is handled.
Let's follow a customer submitting a contact form on a typical WordPress website.
The customer enters their details and clicks the submit button.
The browser sends the information to the website. The website processes the submission and may store it in a database or forward it to an email address.
A notification might then be delivered to the business owner.
If the business uses an external customer relationship management platform, the submission may also be transferred there.
Depending on the configuration, copies could exist in multiple places.
For example:
This creates an important question.
Can you identify every place where your customer's information is stored or processed?
If you cannot, it becomes difficult to manage access, respond to customer requests, determine how long information should be retained, or investigate a security incident.
You do not necessarily need complicated enterprise software to manage this properly.
You need a clear understanding of your website's data flow.
Consider a simple contact form.
Someone wants to ask whether your company provides website design services.
To submit the enquiry, your form requires their full name, email address, phone number, residential address, date of birth, company registration number, and other details.
Does the business genuinely need all that information to answer the enquiry?
Probably not.
Every additional piece of personal information creates another responsibility.
It must be collected for a legitimate reason, protected appropriately, and handled according to the applicable data protection requirements.
The Nigeria Data Protection Act 2023 establishes principles that include collecting personal data for specified and legitimate purposes and limiting collection to what is necessary for those purposes.
This is commonly referred to as data minimisation.
In practical terms, if a customer only needs to provide a name and email address to request a quotation, do not automatically require ten additional fields.
Ask for information because the business needs it, not because your website builder makes it easy to add another input.
A shorter form can also improve the customer experience.
People are generally more willing to submit an enquiry when the process is straightforward.
Reducing unnecessary information collection can therefore support both privacy and usability.
Many businesses add a Privacy Policy page because a website template includes one.
They copy a generic document, change the company name, publish it, and move on.
That approach can create a false sense of security.
A privacy policy should explain how your business handles personal information.
It should reflect what your website actually does.
For example, if your website collects customer names and email addresses through contact forms, your privacy information should explain the relevant purposes and how the information is handled.
If you use analytics tools, marketing services, payment providers, or other third-party systems, those arrangements may also need to be addressed.
A useful privacy notice should help visitors understand:
The exact information required depends on your circumstances and applicable legal obligations.
The Nigeria Data Protection Act 2023 provides the main statutory framework for personal data protection in Nigeria.
The Nigeria Data Protection Commission (NDPC) oversees the framework.
The Act establishes obligations relating to lawful and transparent processing, security, accountability, and the rights of individuals whose personal data is processed.
The NDPC also issued the General Application and Implementation Directive (GAID) in March 2025, with an effective date of 19 September 2025.
Businesses should consider the Act and applicable implementing guidance rather than relying on outdated privacy documents written under earlier regulatory arrangements.
Importantly, consent is not the only possible lawful basis for processing personal data. The appropriate basis depends on the purpose and circumstances. For example, processing may sometimes be necessary to perform a contract or comply with a legal obligation.
This is why copying a generic privacy policy or adding a consent checkbox to every form is not a substitute for understanding your actual processing activities.
You can consult the Nigeria Data Protection Commission for official resources and regulatory guidance.
For a business with substantial or complex data processing activities, professional data protection advice may be appropriate.
This is something many WordPress website owners overlook.
A plugin can provide useful functionality while also interacting with external services.
For example, a form plugin may connect to an email marketing platform.
A live chat plugin may transmit conversation details to an external provider.
An analytics integration may collect visitor activity.
A payment plugin may send transaction information to a payment gateway.
These integrations can be necessary, but businesses should understand what information is being shared and why.
Imagine installing a new marketing plugin because it promises better customer engagement.
You activate it, connect your account, and begin collecting enquiries.
But you never review what information the plugin transfers, which external services process it, or whether the integration is still necessary.
This creates an information gap.
You may know that your website collects customer details, but not know where those details go after submission.
Start by listing the plugins and external services connected to your website.
Pay particular attention to:
For each integration, establish what information it processes and whether that information is necessary for the service.
Review the provider's privacy documentation and security information.
Remove integrations that are no longer required.
Do not assume that a plugin is safe simply because it appears in a popular marketplace. Review its reputation, update history, developer information, permissions, and data-handling practices.
A business may have several people involved in managing its website.
The developer has WordPress administrator access.
A marketing employee manages newsletter subscriptions.
A customer service representative receives contact form notifications.
An external agency manages analytics.
The business owner has access to the hosting account.
This arrangement may be perfectly reasonable, but access should be controlled.
Not everyone needs to see every piece of customer information.
For example, someone responsible for updating website images may not need access to customer enquiries or payment records.
Likewise, an external developer who has completed a project may not need permanent administrator access.
A useful principle is to give people only the permissions necessary to perform their responsibilities.
This is commonly called the principle of least privilege.
For a WordPress website, that means reviewing user roles, removing inactive accounts, avoiding shared administrator credentials, and using appropriate permissions.
For hosting accounts, it means protecting the main account and providing separate access where the platform supports it.
At SIRSTEVEHQ, customers should avoid sharing their primary Client Area credentials unnecessarily. Technical access should be provided according to the requirements of the work being performed.
When a developer or contractor no longer needs access, review and revoke the permissions that are no longer required.
Website owners sometimes assume that data protection begins and ends with their website application.
But the hosting environment matters too.
Your hosting provider supplies infrastructure that may store or process website files, databases, logs, and other information.
Depending on the service arrangement, the provider may also have access to technical information required to operate and maintain the platform.
This means businesses should understand the hosting provider's responsibilities and the security arrangements associated with their service.
Questions worth considering include:
Where is the website hosted?
What security measures are available?
How are hosting accounts protected?
What backup options exist?
How are technical incidents handled?
What information is covered by the provider's privacy documentation?
These questions are relevant whether you use shared hosting, WordPress hosting, or cloud infrastructure.
At SIRSTEVEHQ, we provide different hosting environments for businesses with different requirements, including Shared Hosting, WordPress Hosting, Cloud Hosting, and Enhance Hosting.
Our platforms provide hosting and security capabilities appropriate to their respective services.
However, choosing a hosting provider does not automatically make a business compliant with data protection law.
The business remains responsible for understanding its own processing activities and the obligations that apply to it.
A secure hosting environment is one part of a broader data protection strategy.
Suppose a customer requests the deletion of information held by your business.
You locate their contact form submission and remove it from your WordPress database.
You also delete the email notification from your inbox.
You assume the information is gone.
But what about your website backups?
If a previous database backup contains the same information, that copy may still exist.
This is not necessarily a problem. Backups serve an important purpose, and immediate deletion from every backup is not always technically practical or legally required.
However, businesses should understand how backup retention works and how deletion requests interact with their backup processes.
For example, a business may maintain backups for a defined period and ensure that information deleted from its active systems is not unnecessarily reintroduced during restoration.
The appropriate process depends on the applicable legal requirements, retention obligations, backup architecture, and the rights involved.
At SIRSTEVEHQ, certain hosting environments offer backup capabilities, including Timeline Backups for supported services.
Customers should understand what is covered, the available retention periods, and how restoration works for their specific plan.
Backups are important for business continuity, but they should be included in your information management plan rather than treated as a completely separate issue.
Imagine your business website is compromised.
An attacker gains access to the website database and downloads customer information.
Depending on what the database contains, the exposed information could include names, email addresses, phone numbers, account details, or other personal data.
This is no longer just a website maintenance problem.
It may become a personal data breach with legal, operational, and reputational consequences.
Customers may receive fraudulent messages. Your company may need to investigate what happened, identify affected individuals, and take appropriate action.
Under the Nigeria Data Protection Act, there are obligations concerning personal data breaches, including notification requirements in relevant circumstances.
The applicable requirements depend on the facts and the legal framework. Businesses should not assume every security incident automatically has the same notification obligations.
A breach response process should identify who is responsible for investigating incidents, assessing the information involved, documenting findings, and obtaining professional or regulatory guidance where necessary.
If you suspect that customer information has been exposed:
First, contain the incident. Take appropriate steps to prevent further unauthorised access without destroying evidence needed for investigation.
Second, establish what happened. Identify the affected systems, the type of information involved, and the possible scope of the incident.
Third, secure the environment. Review compromised accounts, credentials, software vulnerabilities, and access permissions.
Fourth, document your findings. Maintain an accurate record of the incident, actions taken, and decisions made.
Finally, assess notification obligations. Determine whether the incident triggers reporting or communication requirements under applicable law.
Do not hide a serious incident simply because you are concerned about how customers might react.
A transparent and properly managed response is important when people's information may be at risk.
Some businesses keep customer information indefinitely.
A contact form submission from five years ago remains in the website database.
Old customer accounts are never reviewed.
Former employees retain access to information they no longer need.
Email notifications remain in mailboxes long after the original business purpose has ended.
This creates unnecessary exposure.
The Nigeria Data Protection Act includes a storage limitation principle: personal data should not be retained for longer than necessary for the purpose for which it was collected or further processed, subject to applicable legal obligations and exceptions.
In practical terms, your business should establish sensible retention periods.
For example, information submitted through a contact form may not need to remain in the website database indefinitely after the enquiry has been resolved.
However, transaction records may need to be retained for accounting, legal, or regulatory purposes.
The correct retention period depends on the type of information and the reason it is being held.
Do not delete information blindly simply because it is old.
Instead, identify the purpose, applicable obligations, and appropriate retention period.
A documented retention policy can help your business make these decisions consistently.
A person requesting a quotation is not automatically agreeing to receive every promotional email your business sends.
These are different activities.
Someone may provide an email address because they want information about a particular service.
That does not mean they want weekly product promotions or unrelated announcements.
Your website should make the distinction clear.
If you collect email addresses for marketing, explain what people are signing up for and provide an appropriate mechanism for managing their preferences or withdrawing consent where consent is the applicable lawful basis.
Do not hide marketing subscriptions inside unrelated forms or make people feel that they must accept promotional messages to receive an ordinary enquiry response.
For businesses using professional email, SIRSTEVEHQ Email Hosting can support custom-domain business communication.
However, normal business mailboxes are not a replacement for a properly configured email marketing platform when sending larger promotional campaigns.
Whichever platform you use, ensure your contact lists are managed responsibly and that your communications comply with applicable privacy and electronic marketing requirements.
You do not need to begin with a complex compliance project.
Start by understanding what your website currently collects.
| Area | What to review |
|---|---|
| Contact forms | Are all requested fields necessary? |
| Newsletter subscriptions | Is the purpose of marketing communication clear? |
| Privacy policy | Does it accurately describe actual data practices? |
| Website plugins | Which services receive or process customer information? |
| User accounts | Who has access, and are permissions appropriate? |
| Hosting | Do you understand the provider's security and privacy arrangements? |
| Backups | What information is retained, and for how long? |
| Where are enquiry notifications and customer correspondence stored? | |
| Retention | When should different categories of information be reviewed or deleted? |
| Security | Are software, passwords, access controls, and recovery arrangements maintained? |
| Incident response | Does your business know what to do if information is exposed? |
| Customer requests | Can you identify and respond to relevant data protection requests? |
For a small business, this checklist is a useful starting point.
Larger organisations or businesses processing sensitive or substantial volumes of personal data may need more formal governance, risk assessments, specialist advice, and additional regulatory compliance measures.
The NDPC's guidance should be consulted when determining the requirements applicable to your organisation.
One of the best times to address data protection is before your website goes live.
It is easier to design a sensible information collection process than to untangle years of poorly documented data handling later.
If you are building a new WordPress website, start by deciding which information you genuinely need.
Choose reputable plugins and services.
Review the privacy documentation of third-party providers.
Protect administrator accounts.
Use appropriate website security measures.
Establish how enquiries, customer accounts, and marketing subscriptions will be handled.
Make sure the business knows where the information is stored and who can access it.
If you use SIRSTEVEHQ hosting, choose an environment appropriate for your application and review the security, backup, and account management features available with your service.
For WordPress projects, SIRSTEVEHQ WordPress Hosting provides a WordPress-focused management environment. Businesses with more demanding infrastructure requirements can also evaluate SIRSTEVEHQ Cloud Hosting.
Where professional business communication is required, SIRSTEVEHQ Email Hosting can provide a separate custom-domain email arrangement.
These services can form part of your website infrastructure, but they do not replace the need for appropriate privacy policies, lawful processing, access management, and organisational controls.
The most important thing is to build responsible data practices into the way your business operates.
Every time someone submits an enquiry, creates an account, or purchases something through your website, they are trusting your business with information about themselves.
That trust should not be taken lightly.
You should know what information you collect, why you need it, where it goes, who can access it, and how long you intend to keep it.
You should also understand what happens when a customer exercises their rights or when a security incident occurs.
For Nigerian businesses, the Nigeria Data Protection Act 2023 makes it particularly important to understand that personal data processing carries legal responsibilities.
But even beyond legal requirements, responsible information management is simply good business practice.
Customers are more likely to trust businesses that communicate clearly and handle their information carefully.
At SIRSTEVEHQ, we believe a website should be more than a place to display products and collect enquiries. It should be built and managed with the reliability, security, and responsibility that customers expect.
Your website may collect the information, but your business is responsible for how that information is handled.
Make sure you know what happens after the customer clicks submit.
If your website processes personal data, your business should understand its transparency and information obligations under the Nigeria Data Protection Act. A privacy notice should accurately explain your data practices. The exact requirements depend on your processing activities and circumstances.
Personal data can include names, email addresses, phone numbers, residential addresses, account details, and other information relating to an identifiable individual. The classification depends on the information and context.
No. The Nigeria Data Protection Act recognises different lawful bases for processing personal data. Depending on the circumstances, processing may be necessary for a contract, legal obligation, consent, or another recognised basis. Businesses should identify the appropriate basis for each purpose.
Yes, WordPress websites can store customer information, but the business must consider security, access controls, retention, backups, and applicable privacy obligations. The suitability of a particular setup depends on the information and how the website is configured.
No. Hosting security is one part of a broader data protection arrangement. Your business must also manage collection purposes, transparency, permissions, retention, third-party integrations, and other applicable responsibilities.
Contain the incident, investigate the affected systems and information, document your findings, secure the environment, and assess applicable notification obligations under the Nigeria Data Protection Act. Seek qualified legal or data protection advice where necessary.
Review them whenever you introduce a new form, plugin, analytics service, payment integration, or other feature that changes how personal data is collected or processed. Periodic reviews are also useful for identifying outdated integrations and unnecessary stored information.
Yes, backups can be important for recovery, but they should be protected and retained according to an appropriate policy. Your business should understand how deleted information is handled within backup retention and restoration processes.
Comments (0)
No comments yet. Be the first to comment!