NDPA compliance

The Nigeria Data Protection Act 2023 (NDPA) is Nigeria's data protection law. It is enforced by the Nigeria Data Protection Commission (NDPC), which took over from the earlier Nigeria Data Protection Bureau. The Commission's General Application and Implementation Directive 2025 (GAID) sets out how the Act is applied in practice. It took effect on 19 September 2025 and ended the earlier Nigeria Data Protection Regulation 2019 (NDPR) and its Implementation Framework.

The NDPA applies to organisations that process personal data in Nigeria, and to organisations anywhere in the world that process the personal data of people in Nigeria. If your application uses Veris to verify the identity of people in Nigeria, the NDPA applies to what you do with that data.

The NDPA requires personal data to be processed in line with a set of core principles. Here is how Veris's design supports each one:

3.1 Veris Capture SDK

All face capture and liveness analysis runs on your end user's device. No image, video frame, biometric feature vector or liveness score is sent to Veris. The SDK returns a signed result containing only a hash of the captured image, a one-way fingerprint that cannot be turned back into a picture. Veris never receives or stores the image.

3.2 Veris Scan SDK

All document reading runs on your end user's device. The document image and the extracted text go straight to your application. No document image, scan result or identity data is sent to or stored by Veris.

3.3 Veris Compare API

Images are sent from your backend server to the Compare API and never directly from an end user's device. For each request:

• Images are handled in memory only and are never written to disk by Veris
• To perform the comparison, the two images are sent over an encrypted connection to a processing partner, which handles them for that single request and does not retain them
• Nothing is kept after the response is returned, including when a request fails
• No image data is logged at any level of detail
• The Compare service has no database connection, so it cannot store data

3.4 SDK telemetry

Anonymous session-outcome telemetry gives you usage analytics on your dashboard. It contains:

• Session outcome (success or failure)
• Error code, if any
• Platform (Android, iOS, Flutter, React Native)
• SDK version
• Timestamp

It does not contain face images, biometric scores, names, phone numbers, email addresses, device identifiers or location. Telemetry is aggregated daily and raw events are deleted after 30 days. You can switch telemetry off from your dashboard.

The NDPA distinguishes the data controller, who decides why and how personal data is used, from the data processor, who handles it on the controller's behalf. For your end users' data, you are the controller.

The NDPA classes biometric data that is used to identify a person as sensitive personal data. A face image captured to confirm who someone is falls in that group. Sensitive personal data may only be processed when a specific condition in the Act is met, such as the explicit consent of the person, or a legal obligation that requires the check.

Veris is designed so that this data does not rest with us. It does pass through your application, and through your backend when you use Compare, so the condition has to be met by you before the camera opens.

Every use of personal data needs a lawful basis. The NDPA lists six: consent, a contract, a legal obligation, protecting someone's vital interests, a task in the public interest, and legitimate interests (which cannot override the rights of the person). For face verification, explicit consent is the usual basis. If you are a regulated financial institution, your know-your-customer rules may instead give you a legal-obligation basis. Take advice on which applies to you.

Where you rely on consent, your application must:

1. Tell users you are collecting and processing their face image and/or identity document
2. Explain the purpose, for example "to confirm your identity before we open your account"
3. Get a clear, affirmative choice from the user before any Veris session starts (no pre-ticked boxes)
4. Let users withdraw consent as easily as they gave it, and request deletion
5. Not make consent a condition of a service where the processing is not needed to provide it

Veris cannot give legal advice. We recommend a qualified Nigerian data protection practitioner reviews your consent flow.

Under the NDPA, the people whose data you hold have these rights against you as the controller:

• Access - to confirm whether you hold their data and to receive a copy
• Rectification - to have inaccurate data corrected
• Erasure - to have their data deleted where the Act allows
• Restriction - to limit how their data is used while a dispute is resolved
• Objection - to object to processing, including for direct marketing
• Portability - to receive their data in a common, machine-readable format
• Withdrawal of consent - at any time, without affecting what was done before
• Human review of automated decisions - not to be subject to a decision based only on automated processing that significantly affects them

That last right matters for verification. Compare returns a similarity score and Capture returns a signed result, but the decision to approve or reject a person is yours. If you make that decision with no human involved, give people a way to ask for a review.

Because Veris does not store end-user personal data, requests from your end users about data in your application go to you, not to Veris. For requests about developer account data that Veris holds, write to [email protected]. Anyone who is unhappy with how their data has been handled can also complain to the Nigeria Data Protection Commission.

The NDPA allows personal data to leave Nigeria only where the destination gives an adequate level of protection, or where another safeguard or condition in the Act applies. Veris runs on infrastructure in Canada. We have assessed this as follows:

• End-user face and document data is never transferred to Veris, because capture and scanning happen on the device
• Compare images are received from your backend and sent over an encrypted connection to a processing partner for one request, then discarded. Neither Veris nor the partner retains them
• Developer account data (name, email, phone, company, billing records) is stored on our servers in Canada under written data processing terms with our infrastructure partners

Our subprocessors are listed in the Privacy Policy: Paystack for payments, Resend for transactional email, Google Analytics on this marketing website, and our infrastructure and image-processing partners.

Veris applies these technical and organisational measures:

• Data in transit: HTTPS with TLS 1.2 or newer, and HSTS on all domains
• Passwords: hashed with bcrypt at a cost of 12 or more
• Licence keys: stored as SHA-256 hashes, never in plain text
• Webhook secrets, two-factor secrets and payment-provider keys: encrypted at rest
• Payments: only payments Veris itself started, for the right amount, are honoured
• Administrator access: email, password and a mandatory two-factor code on every sign-in
• Administrator actions: logged with the time and the administrator, and the log cannot be deleted
• Destructive administrator actions: need two-factor confirmation again at the moment they run
• Compare service: no database, no persistent storage, images handled in memory for one request

The NDPA requires a controller to tell the Nigeria Data Protection Commission about a breach that is likely to put people's rights and freedoms at risk within 72 hours of becoming aware of it. Where the risk to people is high, the people affected must be told immediately, in clear language.

If a security incident affects your data on Veris systems, we will tell you at your registered email address without undue delay, and in any case within 72 hours of our becoming aware of it. We will say what happened, what kinds of data are involved, and what we have done and will do about it.

When you use Veris in your application you are a data controller under the NDPA. Your main obligations are to:

1. Publish a privacy notice that accurately describes your use of face verification and identity documents
2. Have a lawful basis for the processing, and meet the extra condition that applies to sensitive personal data
3. Carry out a data protection impact assessment before you deploy biometric verification, because it is likely to be high risk
4. Appoint a data protection officer if the Commission treats you as a controller or processor of major importance (it decides this by how much data you handle and what the data is)
5. Register with the Commission and file the returns it requires, if you are of major importance
6. Keep end-user data secure wherever your application stores it, including the images and documents the SDKs hand back to you
7. Handle your own cross-border transfers lawfully if you send end-user data outside Nigeria
8. Answer rights requests promptly, and in any case within 30 days
9. Report breaches to the Commission within 72 hours

If you need a signed data processing agreement with Veris, write to [email protected].

For data protection and privacy enquiries: [email protected]
For legal matters and data processing agreements: [email protected]
General enquiries: [email protected]

We aim to answer all privacy enquiries within 5 business days.