Insights / Data protection

What the Nigeria Data Protection Act means for pharma CRM data

By Ava Healthcare11 October 20264 min read

This article is general information to help sales and operations teams ask the right questions. It is not legal advice. For decisions about your company's obligations, speak to your data protection officer or a qualified lawyer, and check the guidance published by the Nigeria Data Protection Commission (NDPC).

The Nigeria Data Protection Act 2023 (NDPA) sets the rules for how organisations handle personal data about people in Nigeria, and it established the Nigeria Data Protection Commission to oversee them. A pharma CRM is full of personal data: names, phone numbers and email addresses of doctors and pharmacists, notes from conversations, visit locations and the details of the reps who use it. That makes the CRM one of the first places to look when you review your data protection practices.

What counts as personal data in a pharma CRM?

Any information that relates to an identifiable person. In a typical field CRM this includes:

• Healthcare professionals' names, specialties, workplaces and contact details.
• Call notes, preferences and anything recorded about what a doctor said.
• Reps' and managers' own data: sign-in details, GPS check-ins, activity and coaching notes.
• Signatures captured for sample receipts, and attendance at events or CMEs.

Information about patients' health is sensitive personal data and needs extra care. As a rule, a commercial CRM should not hold patient-identifiable information at all; train reps to keep call notes about the professional conversation, not about individual patients.

Controller or processor: who is responsible?

The company that decides why and how the data is used is the data controller. For CRM data, that is normally the pharmaceutical company or distributor whose reps collect it. A software provider that stores or handles the data on the company's behalf is usually a data processor, acting on the controller's instructions. Your contract with any CRM provider should make these roles clear.

The principles to build around

The NDPA expects personal data to be handled according to principles that will feel familiar to anyone who knows other modern data protection laws:

• Lawful, fair and transparent: have a lawful basis for keeping each type of data, and tell people what you hold and why.
• Purpose limitation: use data for the purposes you collected it for, not for something unrelated.
• Data minimisation: keep only what you need. Free-text fields often collect more than anyone intended.
• Accuracy: keep records up to date, and correct them when asked.
• Storage limitation: decide how long you keep data and delete what you no longer need.
• Security and confidentiality: protect data against loss and unauthorised access.
• Accountability: be able to show how you comply, not just say it.

Rights of the doctors and pharmacists in your records

The people in your CRM have rights under the Act, including to be informed, to access their data, to have it corrected or deleted in appropriate cases, and to object to certain uses. In practice your team needs a simple way to find everything held about one person, correct it, and remove it when that is the right outcome, and someone who knows how to respond to a request on time.

Practical steps for a pharma sales team

1. Map what you hold. List the CRM fields, attachments and exports, and who can see them.
2. Limit access by role. Reps should see their own territory, managers their team. Avoid shared logins.
3. Control exports. CSV exports and spreadsheets on personal laptops are a common weak point. Agree who may export and where files are kept.
4. Know where the data is stored. Ask your CRM provider where your records live, who can access them and which sub-processors are involved.
5. Keep an audit trail. A log of who changed what helps with accuracy and with investigating problems.
6. Plan for incidents. The Act requires certain personal data breaches to be reported to the Commission quickly, generally within 72 hours of becoming aware of them, so have a plan before you need it.
7. Train the field team. Short, practical guidance on what to write in call notes does more than a long policy nobody reads.

Depending on the volume and type of data it processes, an organisation may also be classed as a data controller or processor "of major importance", with extra obligations such as registering with the Commission. Check the current NDPC guidance to see whether this applies to you.

Questions to ask any CRM provider

• Where is our data stored, and can we get all of it back in a usable format?
• Who at the provider can see our records, and when?
• Can access be restricted by role and territory?
• Is there an audit log of changes?
• If AI features are used, what data is sent, to whom, and can we turn them off?

Back to all insights