A privacy policy is a map, not a template

Young lawyers are often handed a privacy notice and asked to “localise it.” The document was written for a different product, usually in a different country. Swapping the company name does not localise it. It publishes a description of software that does not exist, and it hides the software that does.

A functional notice can be checked against a data dictionary. Every category in the notice is a field someone can point at. Every SDK that receives a copy is named. The retention period is the same number as the job that deletes the rows. If the database is in another country, the notice says so, because the bytes are already there whether or not the paragraph is.

The Nigeria Data Protection Act is the statute this path keeps in view. This note does not restate it, and it is not a precedent you should attach to a board pack. It is a reason to start the draft from the product manager’s schema instead of from a search result.

The data-mapping lesson is the practical version. Read that before you draft.