Evidence Generation
Asia
Evidence Generation
Asia
Revised Date: August 2026
Innovations for Poverty Action LTD/GTE (“IPA Nigeria,” “we,” “us,” or “our”) is committed to protecting the personal data of everyone who interacts with IPA Nigeria, including research participants, program partners, job applicants, donors, vendors, and visitors to the IPA Nigeria website. This notice explains what personal data IPA Nigeria collects, why it is collected, how it is used and shared, and the rights available to individuals under the Nigeria Data Protection Act, 2023 (“NDPA”) and the Nigeria Data Protection Commission's General Application and Implementation Directive, 2025 (“GAID”).
This notice applies to personal data that IPA Nigeria processes in connection with its research, program implementation, and operations in Nigeria. Consistent with the territorial scope of the NDPA and GAID, it applies whether the data subject is located in Nigeria or is a Nigerian citizen residing abroad, and regardless of where the processing technically takes place, where that processing relates to IPA's activities connected to Nigeria.
Innovations for Poverty Action LTD/GTE may collect, use, store, and transfer different kinds of personal data, which we have grouped into the categories below. We collect only the categories of personal data necessary for the specific research, program, or operational purpose at hand, consistent with the data minimization principle set out in the NDPA.
| Category | Examples |
| Identity and contact data | Full name, date of birth, gender, marital status, nationality, National Identification Number (NIN), residential and business address, telephone number, and email address. |
| Project and research data | Survey and interview responses, household- or community-level data, and outcome data collected for a specific research study or evaluation. |
| Financial data | Bank account details, Bank Verification Number (BVN), and payment records, collected to disburse participant incentives, stipends, or vendor and grant payments. |
| Employment and recruitment data | Curriculum vitae, employment history, educational qualifications, and referee contact details submitted as part of a job application. |
| Technical and usage data | IP address, device identifiers, browser type, and information about how a visitor uses the IPA website. |
| Sensitive personal data | Information such as health status, biometric data, or ethnic origin, collected only where necessary for a specific, disclosed research purpose and on the basis of explicit consent or another lawful basis under Section 30 of the NDPA. |
| Communications | Information contained in emails, letters, or other correspondence sent to IPA Nigeria. |
Methods of collection
IPA Nigeria collects personal data directly from individuals through surveys, forms, interviews, phone calls, email correspondence, physical requests, and job applications. We may also collect data automatically through cookies and similar technologies when a person visits the IPA website (see Section 5, “Cookies and Website Tracking”).
Purposes of processing
We use personal data to design and conduct research studies and evaluations, administer participant incentives and stipends, recruit and manage staff, respond to inquiries, process donations, comply with donor and regulatory reporting requirements, plan and host events, and maintain and improve the IPA website and communications.
IPA Nigeria relies on one or more of the following lawful bases for processing personal data, consistent with Section 25 of the NDPA:
IPA Nigeria does not seek, accept, or rely on consent obtained in a manner that would facilitate hate speech, violation of children's rights, criminal activity, or other anti-social conduct.
The IPA website uses cookies and similar tracking technologies. Consistent with Article 19 of the GAID, IPA Nigeria displays a clear and prominent cookie notice when a visitor first accesses the website, obtains opt-in consent before placing any cookie that is not strictly necessary for the website to function, and does not rely on pre-checked boxes or implied consent. Visitors may decline non-essential cookies without losing access to the website's core content. For further detail, see IPA's website cookie policy.
IPA Nigeria may disclose personal data to:
IPA Nigeria does not sell, trade, or rent personal data. Any third party that processes personal data on IPA Nigeria's behalf is contractually required to apply protections consistent with the NDPA and GAID.
IPA Nigeria may transfer personal data outside Nigeria, including to IPA's global offices or international research collaborators, where necessary to fulfill a research, employment, or administrative purpose. Consistent with the GAID, any such transfer relies on one of the following safeguards: an adequacy determination recognized by the Nigeria Data Protection Commission; standard contractual clauses or another approved contractual safeguard; binding corporate rules; an approved code of conduct or certification mechanism; or another lawful exception, such as a transfer necessary to perform a contract with the individual.
IPA Nigeria retains personal data only for as long as necessary to fulfill the purpose for which it was collected, including any period required by Nigerian law, donor agreements, or research protocols such as institutional review board requirements. When personal data is no longer needed, IPA Nigeria securely deletes or anonymizes it, or, where immediate deletion is not possible (for example, because the data is held in backup archives), isolates it from further processing until deletion is possible.
IPA Nigeria applies technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, and destruction. These measures include staff training, encryption of laptops and devices, strong password controls, virus and malware detection, and regular review of our security practices. No method of transmission over the internet or electronic storage is completely secure, and IPA Nigeria cannot guarantee absolute security.
Subject to the conditions and exceptions in the NDPA, individuals have the following rights in relation to their personal data. None of these rights are absolute, and IPA Nigeria may be required or permitted by law not to fulfill a particular request.
| Right | What it means |
| To be informed | The right to be told, in clear and accessible language, what personal data IPA Nigeria holds and why it is processed. |
| Of access | The right to request a copy of the personal data IPA Nigeria holds about the individual. |
| To rectification | The right to require IPA Nigeria to correct inaccurate or incomplete personal data. |
| To erasure | The right to request deletion of personal data where it is no longer needed, where consent is withdrawn, or where the individual objects to processing, subject to any legal or research retention requirement. |
| To restrict processing | The right to limit how IPA Nigeria uses personal data in certain circumstances, such as while the accuracy of the data is disputed. |
| To data portability | The right to receive personal data in a structured, commonly used, machine-readable format and to have it transferred to another organization, where technically feasible. |
| To object | The right to object to processing carried out on the basis of IPA Nigeria's legitimate interests or for direct marketing purposes. |
| To withdraw consent | The right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing. |
| Not to be subject to solely automated decisions | The right not to be subject to a decision based solely on automated processing that produces a legal or similarly significant effect. |
| To complain | The right to lodge a complaint with the Nigeria Data Protection Commission or another applicable supervisory authority. |
To exercise any of these rights, an individual should contact IPA Nigeria's Data Protection Officer using the details in Section 13. We may request sufficient information to verify identity before responding to a request, and we aim to respond within one month of receipt, or within three months for complex or multiple requests.
IPA Nigeria has designated a Data Protection Officer (“DPO”) to oversee compliance with the NDPA and GAID: Mubarik Yakubu. The DPO can be reached using the contact details in Section 15.
If IPA Nigeria becomes aware of a personal data breach, it will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of the breach, where the breach is likely to result in a risk to the rights and freedoms of affected individuals. Where a breach is likely to result in a high risk to an individual's rights and freedoms, IPA Nigeria will also notify the affected individual without undue delay and describe the steps taken to remedy the breach.
An individual with a concern about how IPA Nigeria has processed personal data should first contact the Data Protection Officer using the details in Section 13. If the concern is not resolved, the individual may submit a Standard Notice to Address Grievance under the GAID or lodge a complaint directly with the Nigeria Data Protection Commission. We would appreciate the opportunity to address any concern directly before it is escalated.
The IPA website may contain links to websites owned and operated by third parties. These links are provided for convenience only and are not an endorsement of the linked content. This notice does not apply to third-party websites, and IPA Nigeria is not responsible for their privacy practices. We advise visitors to review the privacy policy of any third-party website before providing personal data.
IPA Nigeria may update this notice from time to time to reflect changes in law, regulatory guidance, or our practices. Material changes will be reflected on this page with a revised effective date.
For questions about this notice, to exercise a data subject right, or to report a suspected data breach, please contact:
Mubarik Yakubu
Data Protection Officer, IPA Nigeria
Innovations for Poverty Action LTD/GTE
4 Fez Street, Wuse II, Abuja, Nigeria
Email: NIA_dpo@poverty-action.org
An individual also has the right to lodge a complaint at any time with the Nigeria Data Protection Commission. We would, however, appreciate the opportunity to address the concern directly in the first instance.
