Data Mapping with Product Managers

A privacy notice is a map of a system. If the notice says every password is encrypted and the database holds them in plain text, the notice is evidence against the company that published it. You cannot draft the map by guessing.

Before engineers store a user, they usually sketch a schema: how the records relate. Beside it sits a data dictionary, a list of fields. Names you will actually see include user_full_name, user_phone, bvn_encrypted, gps_coordinates, device_id.

The interview

Sit with the product manager and ask for the dictionary, not for a policy they downloaded. For each field, write four things:

• Where it is collected (which screen).
• Where it is stored (which table, which provider).
• Who can read it, inside the company and outside it.
• Why it exists. If nobody can say, it is a candidate to delete.

The dictionary is how you tell ordinary personal data from material the NDPA treats more carefully — financial information, government identifiers, biometrics, health. Do not upgrade a field to “sensitive” from memory in a live draft. Mark it, then check the statute. The course point is that you found the field at all.

Two states of protection

You will be asked to write “industry-standard encryption.” Know the two states, or the phrase is decorative.

In transit. The data is moving between the phone and the server. HTTPS and TLS are the usual mechanisms. A person who intercepts the journey should see noise. That attack is often called a person-in-the-middle.

At rest. The data is sitting on a disk or in a backup. If someone takes the backup, the rows should still be useless without the key.

A breach note to the Nigeria Data Protection Commission is more credible when it can say which of those was true. This lesson does not set out a filing form.