Executive Privacy Notice
The Chartered Institute of Directors Nigeria (“CIoD Nigeria,” “we,” “our,” or “us”) is committed to protecting the privacy and personal data of our members, visitors, trainees, event attendees, website users, and all other individuals who interact with us. This Privacy Notice explains how we collect, use, disclose, and safeguard your personal data in compliance with the Nigeria Data Protection Act, 2023 (NDP Act) and the General Application and Implementation Directive (GAID) issued by the Nigeria Data Protection Commission (NDPC).
By engaging with CIoD Nigeria—whether through our websites, events, training programmes, membership services, or other interactions—you entrust us with your personal data. We take this responsibility seriously and are dedicated to maintaining transparency, accountability, and the highest standards of data protection.
Key points of this notice:

• We collect personal data only for specified, explicit, and legitimate purposes

• We process your data based on lawful bases as defined by the NDP Act, 2023

• You have rights over your personal data, including access, rectification, and erasure

• We implement robust security measures to protect your information

• We do not sell your personal data to third parties

We encourage you to read this full notice carefully. If you have any questions, please contact our Data Protection Officer using the details provided in Section 12.

1. About CIoD Nigeria

The Chartered Institute of Directors Nigeria is the apex professional body representing directors in their individual capacities across all sectors of the Nigerian economy . Founded on 17 May 1983, CIoD Nigeria has been at the forefront of promoting good governance practices in Nigerian companies and the public sector .
Our mission is to strengthen the professional capacity of directors, business leaders, technocrats, and senior public servants through internationally recognised Director Development Programmes, advocacy, and the promotion of ethical leadership and corporate governance .
In carrying out our activities, we process personal data of various individuals, including:

• Members (across our membership categories)

• Training and event participants

• Website visitors (to https://ciodnigeria.org/ and https://erp.ciodnigeria.org/)

• Job applicants and potential employees

• Stakeholders, partners, and service providers

• Visitors to our offices

As a data controller under the NDP Act, 2023, we determine the purposes and means of processing personal data and are accountable for ensuring compliance with all applicable data protection laws.

2. Personal Data We Collect

We collect personal data that is necessary for our legitimate activities and to fulfil our obligations to you. The categories of personal data we process include:
2.1 Identity and Contact Information

• Full name

• Title and professional designation

• Date of birth

• Gender

• Nationality

• Contact address (residential and business)

• Email address

• Telephone and mobile numbers

• Professional affiliations and memberships

2.2 Professional and Membership Information

• Employment history and current position

• Organisation name and industry sector

• Board memberships and directorships

• Professional qualifications and certifications

• Membership category and history with CIoD Nigeria

• Continuing Professional Development (CPD) records

• Performance and attendance records for training programmes

2.3 Financial and Payment Information

• Bank account details for payments or refunds

• Payment card information (processed securely through third-party payment processors)

• Billing and invoicing information

• Transaction history for memberships, events, and training programmes

2.4 Technical and Usage Data (Website and Portal)

• Internet Protocol (IP) addresses

• Browser type and version

• Operating system and device information

• Referring website URLs

• Pages visited, time spent, and navigation patterns

• Cookies and similar tracking technologies (see Section 9)

• Login credentials for the ERP portal (https://erp.ciodnigeria.org/)

2.5 Communication and Interaction Data

• Correspondence with CIoD Nigeria (emails, letters, phone calls)

• Feedback and survey responses

• Enquiries and complaints

• Social media interactions with our official accounts

2.6 Event and Training Data

• Registration details for events, conferences, and training programmes

• Photographs and videos taken at events (with consent where required)

• Participation records and assessment results

2.7 Sensitive Personal Data
In limited circumstances, we may process sensitive personal data (known as “special categories” of data under the NDP Act), such as:

• Health information (e.g., dietary or accessibility requirements at events)

• Biometric data (e.g., photographs for identification purposes)

Where we process such data, we will obtain your explicit consent or rely on another lawful basis as permitted by the NDP Act, 2023.

3. How We Collect Personal Data

We collect personal data through various channels and interactions:
3.1 Direct Collection from You

• When you register for membership or renew your membership

• When you apply for or participate in training programmes, events, or conferences

• When you create an account on the ERP portal (https://erp.ciodnigeria.org/)

• When you make payments for our services

• When you subscribe to our newsletters, publications, or updates

• When you contact us for information, support, or complaints

• When you complete surveys or provide feedback

• When you submit job applications or expressions of interest

3.2 Automated Collection

• Through cookies and analytics tools when you visit our websites (https://ciodnigeria.org/ and https://erp.ciodnigeria.org/)

• Through log files and server monitoring

• Through the use of our ERP portal

3.3 Collection from Third Parties

• From employers or organisations nominating you for membership or training

• From event partners or co-organisers

• From payment service providers (e.g., Flutterwave, paystack) 

• From publicly available sources for professional and business purposes

• From regulatory bodies and professional associations (with your consent or as permitted by law)

3.4 Collection from Other Sources

• Information provided by your employer or organisation for corporate membership or sponsorship arrangements

• Information received during our advocacy, policy, and stakeholder engagement activities

4. Purposes of Processing

CIoD Nigeria processes your personal data for the following purposes:
4.1 Membership Management

• Processing membership applications, renewals, and resignations

• Maintaining and updating membership records

• Issuing membership certificates and credentials

• Collecting membership fees and managing subscriptions

• Communicating membership benefits, services, and updates

4.2 Training and Professional Development

• Registering participants for Director Development Programmes and events

• Managing attendance, assessments, and certification

• Issuing CPD credits and certificates

• Customising training content based on professional needs

• Evaluating and improving training programmes

4.3 Event Management

• Organising and managing conferences, seminars, and networking events

• Processing event registrations and payments

• Managing venue logistics, catering, and accessibility needs

• Facilitating networking opportunities among participants

• Communicating event information and updates

4.4 Communication and Public Relations

• Sending newsletters, publications, and industry updates

• Informing you of events, training, and other opportunities

• Sharing information about corporate governance developments

• Responding to your enquiries and requests

• Managing our social media presence and engagement

4.5 Website and Portal Operations

• Operating and maintaining our websites and ERP portal

• Managing user accounts and access controls

• Improving user experience and website functionality

• Analysing website usage to optimise content and services

• Ensuring the security of our digital platforms

4.6 Advocacy and Policy Engagement

• Supporting our advocacy initiatives on corporate governance

• Engaging with policymakers and stakeholders on relevant issues

• Representing members’ interests at national and international levels

• Contributing to research and publications on governance

4.7 Administrative and Compliance Purposes

• Maintaining financial records and accounts

• Auditing and compliance with legal and regulatory requirements

• Managing risks and insurance

• Processing complaints and disciplinary matters

• Ensuring the security of our premises, data, and systems

4.8 Research and Development

• Conducting research on corporate governance and director development

• Analysing trends and needs of our membership

• Developing new programmes and services

• Measuring the impact and effectiveness of our activities

5. Lawful Bases for Processing

In compliance with the Nigeria Data Protection Act, 2023, we process personal data only when we have a lawful basis to do so . The lawful bases we rely on are:
5.1 Consent
We process your personal data based on your explicit consent for specific purposes, including:

• Sending you promotional and marketing communications

• Processing sensitive personal data (e.g., health information)

• Using cookies and tracking technologies (where consent is required)

• Publishing photographs and videos from events

Article 19 of the GAID specifies that consent to cookies and other tracking tools must be obtained in a manner that is freely given, specific, informed, and unambiguous . You have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
5.2 Contract
We process personal data when necessary for the performance of a contract with you, including:

• Membership contracts and agreements

• Training and event registration contracts

• Service agreements with partners and service providers

Article 21 of the GAID confirms that reliance on contract as a lawful basis is appropriate where processing is necessary for the performance of a contract to which you are a party .
5.3 Legal Obligation
We process personal data to comply with legal and regulatory obligations, including:

• Tax and financial reporting requirements

• Anti-money laundering and counter-terrorism financing obligations

• Compliance with court orders and regulatory investigations

• Reporting obligations to the Nigeria Data Protection Commission

Article 22 of the GAID provides that reliance on legal obligation is justified where processing is necessary for compliance with a legal obligation to which we are subject .
5.4 Legitimate Interests
We process personal data where it is necessary for our legitimate interests or those of a third party, provided that such interests are not overridden by your rights and freedoms . This includes:

• Improving our programmes, services, and membership experience

• Promoting corporate governance and director development

• Conducting research and analysis

• Ensuring the security of our operations and data

• Engaging in advocacy and policy activities

Article 26 of the GAID requires us to evaluate the legitimate interests basis carefully, ensuring that our interests are balanced against your rights and freedoms .
5.5 Public Interest
We may process personal data where necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us. This relates to our role in promoting corporate governance and professional standards in Nigeria.

6. Sharing and Disclosure of Personal Data

CIoD Nigeria may share your personal data with third parties in the following circumstances:
6.1 Service Providers and Partners
We engage trusted third-party service providers to assist with our operations, including:

• Payment processors (e.g., Flutterwave for online payments) 

• IT service providers and website hosting

• Event management and logistics companies

• Training partners and facilitators

• Marketing and communications agencies

• Legal and accounting professionals

All service providers are contractually obligated to process personal data only on our instructions and in accordance with applicable data protection laws. We require them to implement appropriate security measures.
6.2 Professional and Regulatory Bodies
We may share personal data with:

• The Nigeria Data Protection Commission (NDPC) for compliance purposes

• Professional associations and regulatory bodies relevant to our activities

• Government agencies where required by law

6.3 Event and Training Participants
In the context of events and training programmes, we may share limited participant information (such as names, titles, and organisations) with other attendees for networking purposes. You will be informed of this at the time of registration.
6.4 Legal and Compliance
We may disclose personal data where required by law, regulation, or legal process, including:

• In response to court orders or regulatory investigations

• To enforce our terms and conditions

• To protect the rights, property, or safety of CIoD Nigeria, our members, or others

6.5 Business Transfers
In the event of a merger, acquisition, or reorganisation, we may transfer personal data to the successor entity, subject to compliance with applicable data protection laws.
6.6 With Your Consent
We will share your personal data with third parties when we have obtained your explicit consent for such sharing.
We do not sell, rent, or trade your personal data to third parties for marketing purposes.

7. International Data Transfers

CIoD Nigeria is committed to ensuring that your personal data is protected when transferred outside Nigeria. In the course of our activities, we may transfer personal data to recipients in other countries for purposes such as:

• Collaborating with international professional bodies and partners

• Using cloud-based IT services and platforms

• Engaging international training facilitators or consultants

Article 45 of the GAID provides guidance on cross-border data transfer . We ensure that any international transfer of personal data is carried out in compliance with the NDP Act, 2023, including by:

1. Transferring only to countries with adequate data protection laws that provide a level of protection comparable to Nigeria’s standards

1. Implementing appropriate safeguards, such as Standard Contractual Clauses approved by the NDPC

1. Obtaining your explicit consent where required

1. Conducting Data Privacy Impact Assessments for higher-risk transfers

1. Ensuring that third parties processing data on our behalf adhere to the same data protection standards

We recognise that transfers to jurisdictions with weaker data protection may involve risks, including increased exposure to unauthorised access, limited recourse for data breaches, and inadequate security measures. We take steps to mitigate these risks through contractual safeguards and security measures.

8. Data Security

CIoD Nigeria implements robust technical, administrative, and physical security measures to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure. These measures include:
8.1 Technical Measures

• Encryption: Data is encrypted in transit (using TLS/SSL protocols) and at rest

• Access Controls: Role-based access control (RBAC) ensures only authorised personnel have access to personal data

• Authentication: Multi-factor authentication (MFA) for access to our systems

• Firewalls and Intrusion Detection: Network security measures to prevent unauthorised access

• Regular Security Testing: Vulnerability assessments and penetration testing

• Audit Logging: Monitoring and logging of all access to personal data

8.2 Administrative Measures

• Data Protection Policies: Comprehensive policies and procedures governing data handling

• Staff Training: Regular training on data protection and privacy for all personnel

• Data Processing Agreements: Contractual obligations on our service providers to maintain data security

• Data Privacy Impact Assessments: Conducted for high-risk processing activities

• Incident Response Plan: Procedures for detecting, reporting, and responding to data breaches

Article 29 of the GAID mandates the monitoring, evaluation, and maintenance of data security systems . We are committed to complying with this requirement and regularly reviewing our security practices.
8.3 Physical Security Measures

• Secured Premises: Physical access controls at our offices

• Document Security: Secure storage and disposal of physical records containing personal data

• Device Security: Management of devices used for processing personal data

Article 32 of the GAID requires measures against privacy breach abetment . We ensure that our security measures protect against both internal and external threats.
8.4 Data Breach Notification
In the event of a data breach that may compromise your personal data, we will:

• Notify the Nigeria Data Protection Commission within 72 hours of becoming aware of the breach (as required by Article 33 of the GAID) 

• Communicate with affected data subjects where the breach is likely to result in a high risk to your rights and freedoms

• Provide information about the breach, its potential consequences, and any mitigation measures taken

9. Data Retention

CIoD Nigeria retains personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory obligations, and to protect our legitimate interests.