Church & School CCTV Privacy Rules in Nigeria (NDPA)

# Cameras in Churches and Schools: The Consent and Notice Requirements Nigerian Operators Need to Meet

TL;DR: If your church, mosque, or school runs CCTV in Nigeria, the Nigeria Data Protection Act 2023 and its 2025 implementation directive still apply to that footage. That means proper notice, a documented lawful basis, a written retention period, a mandatory impact assessment for cameras in places the public can enter, and (for schools) a parental consent workflow, even where the institution itself is exempt from registration.

This article is general information, not legal advice.

Why this matters now, not five years from now

Churches, mosques and schools install CCTV for good reasons: break-ins, safety at school gates, cash handling. The installation conversation is usually about cameras and recorders, not about who the footage belongs to, how long it's kept, or what happens when a parent asks to see the clip of their child at the school gate.

Those questions now have legal answers. Nigeria's data protection regime has moved from a thin 2019 regulation (the NDPR) to a full statute — the Nigeria Data Protection Act 2023 (NDPA) — backed by an active regulator, the Nigeria Data Protection Commission (NDPC), and as of March 2025 a detailed General Application and Implementation Directive (GAID), which took effect on 19 September 2025; under Article 3(3) of the GAID the Commission no longer applies the old NDPR as a legal instrument (Templars, 2025; DLA Piper Privacy Matters, 2025). CCTV footage of identifiable people is personal data under this framework, full stop — there's no house-of-worship or classroom carve-out from that basic definition.

The three things the NDPA actually requires

Strip away the legal language and church/school CCTV compliance comes down to three core obligations, plus the extra layer for children covered below.

1. A lawful basis for recording, not just a reason

Under Section 25 of the NDPA, processing personal data (including capturing someone on camera) needs a lawful basis: consent, contract, legal obligation, vital interest, public interest or legitimate interest. "We needed the cameras after the last robbery" is a real justification, but it needs to be written down. If you rely on legitimate interest, Article 26 of the GAID makes a Legitimate Interest Assessment mandatory before processing starts, and Schedule 8 of the GAID provides a template (purpose, necessity and balancing tests). Without it, you have nothing to show when a member, a parent or the NDPC asks.

2. Notice people can actually read

Where consent is used, the NDPA defines it as a "freely given, specific, informed, and unambiguous" indication (Section 65). But even where a church relies on legitimate interest rather than consent for general perimeter CCTV, the transparency duty still applies. Section 27 of the NDPA requires the controller to tell people who it is, the lawful basis and purpose, their rights, the retention period and how to complain to the NDPC, and Article 7(m) of the GAID requires privacy notices to be "transparent and appropriately provided on platforms/places where data processing is taking place". For a physical space, that means:

Visible signage at entrances stating cameras are in use, who operates them, and roughly why (security).
A short line in the school's admission pack or the church's membership/visitor materials explaining that CCTV covers common areas.
A named contact (even just an email) for anyone who wants to ask what's recorded or request footage.

A sticker at the gate that just says "SMILE, YOU'RE ON CAMERA" is not notice under the NDPA: it doesn't identify the controller, the purpose, or how to exercise a data subject right.

3. Retention limits, in writing

Section 24(1)(d) of the NDPA says personal data may be retained for no longer than is necessary for the purpose it was collected for, so indefinite storage breaches a core principle and can attract an NDPC sanction. The law sets no fixed number of days for CCTV. Two things are fixed, though: the GAID requires a written retention policy that is communicated to data subjects (Schedule 1), and Article 49(3) says that where no law sets a time limit, storage must end no later than six calendar months after the original purpose has been accomplished. In practice this means a written retention schedule with a short rolling overwrite for routine security footage (you choose the number and record why), plus a documented exception process for clips genuinely needed as evidence (a break-in, an assault allegation, a custody dispute at pickup time). "The DVR just keeps recording until the disk is full" is not a retention policy; it's the absence of one.

Where children make this materially harder

Schools carry an extra layer that churches mostly don't: the people on camera are children. Section 31(1) of the NDPA says that where a controller relies on consent for a child, it must obtain the consent of a parent or legal guardian, and must use appropriate mechanisms to verify age and consent. Section 31(4) lists exceptions, including processing needed to protect the child's vital interests and processing for education, medical or social care purposes carried out by a professional owing a duty of confidentiality. The GAID goes further on the consent side: Article 18(1)(d) lists the processing of a child's personal data among the activities that require consent. How those two provisions interact for routine school CCTV is not settled, so the prudent course is to get documented parental consent: a school's admission agreement should explicitly cover CCTV in classrooms, corridors and gates as part of the enrolment paperwork parents sign, rather than burying it in a general "school rules" document (Aluko & Oyebode; SRJ Legal).

The GAID also makes a Data Privacy Impact Assessment mandatory and fileable with the NDPC in several situations that describe most school and church camera systems: surveillance cameras in places the public can access, processing that relates to vulnerable data subjects such as children, and educational services processing students' or pupils' records (Article 28(3)(e), (k) and (m)). The DPIA must be vetted by a DPO certified by the Commission.

This gets more sensitive once cameras move from perimeter security to classroom monitoring, or to any biometric layer such as facial-recognition attendance. Biometric data used to identify someone is sensitive personal data under the NDPA, which needs a Section 30 ground (in practice, consent) on top of everything above, so a facial-recognition register of children's faces is a materially bigger compliance lift than a static entrance camera.

The registration wrinkle that's confusing operators

Here's where it gets genuinely messy, and worth clearing up because it's a live source of bad advice. Section 44 of the NDPA requires data controllers and processors of major importance (DCPMI) to register with the NDPC; the NDPC decides who qualifies. Its Guidance Notice on registration, now reproduced as Schedule 7 of the GAID, designates an organisation that keeps a filing system as being of major importance if it processes the personal data of more than 200 data subjects in six months or operates in a listed sector, which includes education. It names primary and secondary schools expressly in the Ordinary High Level tier (₦10,000 registration fee), and higher institutions in the Extra-High Level tier. The first registration window closed on 31 October 2024 after two extensions from 30 June 2024 (OAL Law; Mondaq).

Churches and mosques are a different story, and a debated one. Paragraph 6 of the same Guidance Notice (GAID Schedule 7), relying on the Commission's power in Section 44(6) of the NDPA to exempt classes of controllers, exempts faith-based organisations (along with community-based associations and a few others) from registration. At least one Nigerian lawyer has argued that the exemption sits awkwardly with the Act, since a large congregation's membership and giving records look like data of "particular value or significance" (Loyal Nigerian Lawyer). What the exemption does not do is remove the substantive obligations (lawful basis, notice, retention limits, DPIAs where mandatory, breach reporting) that apply to every controller under the NDPA regardless of registration status. Note too that records revealing religious belief are themselves sensitive personal data under Section 65; Section 30(1)(d) lets a religious non-profit process such data about its members and regular contacts, with appropriate safeguards, as long as it isn't disclosed outside the organisation without explicit consent. A church can be exempt from filing paperwork with the NDPC and still be squarely on the hook if a member's CCTV footage leaks or an usher's phone with recordings gets lost.

What non-compliance actually costs

The NDPA gives the NDPC real teeth. Under Section 48, a data controller or processor of major importance can face a penalty of up to the higher of ₦10 million or 2% of annual gross revenue, and any other controller or processor up to the higher of ₦2 million or 2%. Where an organisation commits an offence under the Act (such as ignoring a compliance order), Section 53 deems its principal officers culpable too unless they show they did not consent and exercised diligence. Section 40 of the NDPA sets a 72-hour clock for notifying the NDPC of a breach likely to put people's rights at risk, and requires immediate notification to affected individuals where the risk is high; Article 33 of the GAID repeats and details these duties. For a school, "high risk" plausibly includes CCTV footage of minors ending up somewhere it shouldn't — which is a reputational event long before it becomes a regulatory one.

A practical compliance checklist

Requirement	Church	School
Documented lawful basis for CCTV (plus LIA if relying on legitimate interest)	Yes	Yes (plus parental consent for children)
DPIA filed with the NDPC	Yes if public-access areas are covered	Yes (children, education records, public-access areas)
Entrance/perimeter signage	Yes	Yes
Named contact for footage requests	Yes	Yes
Retention schedule (written)	Yes	Yes
CCTV clause in enrolment/membership paperwork	Recommended	Required
DCPMI registration with NDPC	Exempt as a faith-based organisation (GAID Schedule 7, para 6)	Required: primary and secondary schools are named in the Ordinary High Level tier
Breach notification process (72-hour clock)	Yes	Yes

None of this requires ripping out existing camera systems. It requires a short data-protection policy document, some signage, a line item in onboarding paperwork, and — critically — someone who owns the process so it doesn't quietly lapse when the person who installed the cameras moves on. For organisations running this alongside a website, member portal or admissions system, it makes sense to design retention, access control and consent records into the platform itself; Wise Hustlers' private sector programme describes how we scope that kind of build.

FAQ

Does a small neighborhood church really need to worry about the NDPA?

Yes, in substance, even though faith-based organisations are exempt from the registration requirement under GAID Schedule 7. The underlying obligations (lawful basis, notice, retention limits, a DPIA where cameras cover public-access areas, and breach handling) apply to any organisation processing personal data, camera footage included, regardless of registration status.

Is a "CCTV in use" sign at the gate enough notice under Nigerian law?

Not on its own. NDPA-compliant notice needs to identify who operates the cameras, roughly why, and how someone can ask about footage or exercise a data right — a bare warning sign misses the identification and contact-point elements.

Can a school legally record children on CCTV without asking every parent individually every time?

Generally yes for routine security CCTV, provided parental consent covering CCTV was obtained clearly as part of enrolment, the school has a documented lawful basis and DPIA, and parents are told how long footage is kept. Consent does not have to be re-collected every time. Facial recognition or other biometric systems involve sensitive personal data and warrant separate, specific consent.

How long can a school or church legally keep CCTV footage?

Neither the NDPA nor the GAID sets a fixed number of days for CCTV. The NDPA requires retention for no longer than necessary for the stated purpose (Section 24(1)(d)), and GAID Article 49(3) caps storage at six calendar months after the purpose has been accomplished where no other law sets a limit. Pick a short rolling overwrite for routine footage, write down why that period fits your purpose, and keep a documented process for preserving specific clips needed as evidence.

Cameras in Churches and Schools: The Consent and Notice Requirements Nigerian Operators Need to Meet