The 72-Hour Rule: Exactly What Your School Must Do After a Data Breach

Picture This: Monday Morning, 7:40 a.m.

Your vice principal walks into your office with bad news. Her laptop, which holds the admission records of 600 pupils, was stolen from her car over the weekend. Or this one: a class teacher accidentally forwards the term's fee-defaulters spreadsheet to the PTA WhatsApp group instead of the bursar. Or the school's admin computer greets Monday with a ransomware note demanding payment in dollars.

In each of these cases, a legal clock has already started ticking. Under the Nigeria Data Protection Act 2023, once your school becomes aware of a personal data breach that is likely to put people at risk, you have 72 hours to notify the Nigeria Data Protection Commission. Not 72 hours from when you finish investigating. Seventy-two hours from when you become aware.

Most Nigerian schools have no plan for this moment. This article gives you one.

First, What Counts as a Personal Data Breach?

A personal data breach is any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. In school life, that covers more than hacking:

• A stolen or lost laptop, phone, or USB drive holding pupil or staff records.
• A ransomware infection on the admin computer.
• Emailing or messaging a spreadsheet of pupil records to the wrong recipient.
• Posting pupils' photos, medical details, or disciplinary records in a staff WhatsApp group.
• A vendor, such as your SMS portal or results-checking provider, suffering a compromise that exposes your pupils' data.
• A former staff member who still has the password to the school portal.

If it involves names, addresses, phone numbers, photographs, biometric fingerprints, medical records, or fee records of pupils, parents, or staff, treat it as a data breach until you have reason to conclude otherwise.

What the Law Actually Requires, in Plain English

Section 40 of the Nigeria Data Protection Act 2023 sets out the duties. The NDPC's General Application and Implementation Directive (GAID) 2025 adds the operational detail. Here is what matters for a school:

• Notify the Commission within 72 hours. Where a breach is likely to result in a risk to the rights and freedoms of individuals, the data controller must notify the NDPC within 72 hours of becoming aware, describing the nature of the breach and, where feasible, the categories and approximate numbers of people and records affected.
• Tell the affected people immediately when the risk is high. Where the breach is likely to result in a high risk to a person, for example exposure to fraud, identity theft, or exposure of sensitive personal data, the school must communicate the breach to the affected data subjects in plain and clear language, including advice on steps they can take to protect themselves.
• Your vendors must alert you. If a data processor you engaged, such as a portal or SMS provider, becomes aware of a breach, it must notify you promptly and answer your questions so you can meet your own obligations.
• Say what happened and what you are doing about it. The notification should cover the circumstances of the breach, the data and numbers involved, your assessment of the harm, the mitigation steps taken, and a contact point.
• Keep a record. Document the circumstances of every breach, its consequences, and the corrective measures you took, so the Commission can verify your compliance.
• Act fast on imminent danger. Where immediate information could help contain a breach at a wider scale, the duty of care requires alerting the relevant authorities without waiting out the clock.

The Act provides for administrative fines for violations, and the NDPC is currently running sector-by-sector enforcement across education. This article is general guidance, not legal advice. For a live incident, involve your Data Protection Officer and legal counsel.

The 72-Hour Playbook

Print this section. Put it in the admin office. When an incident happens, work it step by step.

Hours 0 to 4: Contain and Preserve

• Do not wipe or reformat the affected device. Wiping destroys the evidence you need to understand what happened and to show the Commission you acted responsibly.
• Stop the bleeding. Disconnect the affected computer from the network if malware is suspected. Revoke shared passwords. Disable the compromised account. Ask the vendor to suspend the exposed portal if the breach sits with them.
• Assemble a small response team. The proprietor or principal, the head of administration, whoever handles IT, and your Data Protection Officer or data protection contact. Four people is enough. Large committees slow everything down.
• Open an incident log. Write down who discovered what, at what time, and every action taken from this moment onward. This log becomes your most valuable document.

Hours 4 to 24: Assess

• What data was involved? Names, addresses, phone numbers, photographs, fingerprints, medical records, fee payment records. Be specific.
• Whose data, and how many people? Pupils, parents, staff. Approximate numbers are acceptable at this stage.
• How did it happen, and is it still happening? A one-off email to the wrong group is contained. An attacker with ongoing access is not.
• Run the risk test. Could the exposed data lead to fraud, identity theft, or exposure of sensitive personal data? When children are involved, treat the bar for risk as lower and your duty of care as higher. If the answer is yes, the 72-hour notification duty is triggered. If the risk is high, the affected parents or staff must be told promptly.

Hours 24 to 48: Notify

• File the NDPC notification within 72 hours of awareness. Include what happened, the categories and approximate numbers of people and records affected, your assessment of the risk, the steps you have taken to limit the harm, and a contact person. You may update the Commission as more facts emerge. Waiting until you know everything is a mistake; the clock runs from awareness.
• Notify affected parents and staff in plain language where the risk is high. Say what happened in one paragraph, whose data was involved, what the school is doing, concrete steps they should take, and who to contact with questions. Calm, specific, and actionable beats legal and vague every time.

Hours 48 to 72: Document and Strengthen

• Complete the incident record: timeline, data involved, people affected, notifications made, and corrective actions.
• Fix the root cause: change passwords, patch the system, restrict who can access pupil records, and brief the staff involved.
• Ask the hard question: could this happen again next term? If yes, you have a project, not just an incident.

What to Say to Parents (and What Not to Say)

The parent notification is where schools most often fail. A good notice has five parts: a calm greeting, one paragraph on what happened, whose data was involved, what the school is doing about it, and three concrete steps the parent can take, such as watching for suspicious calls or messages, never sharing one-time passwords, and reporting anything unusual to the school's contact person. End with a named contact and a phone number.

Avoid dense legal language that parents cannot act on. Avoid shifting blame to a staff member by name. Avoid the empty phrase "we take security seriously" with no facts attached. And avoid silence. Silence reads as cover-up, and in an enforcement climate it is the riskiest option of all.

Five Mistakes That Turn a Breach Into a Penalty

1. Waiting to finish investigating before notifying. The 72 hours run from awareness, not from full understanding. File, then update.
2. Wiping the device or deleting the evidence. Preserve first, clean later.
3. Saying nothing and hoping nobody notices. With the NDPC actively probing the education sector, silence is the worst strategy.
4. Notifying in language parents cannot act on. If they cannot understand it, you have not communicated it.
5. Keeping no written record. Without an incident log, you cannot prove diligence to anyone, including the Commission.

Make the Next 72 Hours Boring: Prepare Now

The schools that handle breaches well are the ones that prepared when nothing was on fire. Three things to do this term:

• Know who your Data Protection Officer or data protection contact is, and make sure every head of department has their number.
• Keep an updated map of where pupil data lives: which devices, which spreadsheets, which portals, which vendors.
• Run our free NDPA school audit to find your gaps before an incident finds them for you.

Harmony Digital Consults helps schools build these safeguards through HavonaShield, our cybersecurity and data-protection implementation support for schools, covering incident response planning, staff training, and NDPA-aligned practices. Talk to us before the clock starts.