Candidate data privacy: what HR teams in Nigeria should know

CVs, phone numbers, employment history, interview recordings: recruitment collects a large amount of personal information about people who are not (yet) your employees. Handling it carefully is both a legal obligation and a matter of trust.

This article is general guidance, not legal advice. Speak to a qualified adviser about your organisation's specific obligations.

The legal backdrop

In Nigeria, the Nigeria Data Protection Act 2023 sets out how personal data must be handled, and the Nigeria Data Protection Commission oversees compliance. If you recruit in other countries, their data protection laws may apply as well.

Principles to build into your hiring process

• Collect only what you need. Ask for information that is relevant to assessing the candidate for the role.
• Be clear about why. Tell candidates how their data will be used in your privacy notice.
• Get consent where it is required, for example before recording an interview.
• Limit access. Only people involved in the hiring decision should see applicant data.
• Do not keep data forever. Set retention periods and delete what you no longer need.
• Respond to requests. Candidates can ask what data you hold about them.

How HR Paddy supports this

• Candidates see a consent notice before any AI interview recording begins.
• Interview recordings are automatically deleted within 48 hours.
• Role-based access means team members only see what their role allows.
• Applicants accept the privacy policy and terms before they submit.

Simple habits for your team

Avoid downloading CVs to personal devices, do not forward applicant data over personal email or chat apps, and review who has access to your recruitment workspace whenever someone joins or leaves the team.

Frequently asked questions

Which law covers candidate data in Nigeria?

The Nigeria Data Protection Act 2023 sets out how personal data, including CVs and interview recordings, must be handled, and the Nigeria Data Protection Commission oversees compliance. If you recruit in other countries, their data protection laws may apply too. This is general guidance, not legal advice.

How long should HR keep candidate data?

Only as long as you need it. Set retention periods for applications and recordings and delete what you no longer need. On HR Paddy, AI interview recordings are deleted automatically within 48 hours.

Do I need consent to record a job interview?

Get consent wherever it is required, and always before recording. HR Paddy shows candidates a consent notice before any AI interview recording begins.