Drafting Functional Privacy Policies

The failure mode this course keeps returning to is a policy copied from another country and another product, with the company name swapped. A functional notice is Nigeria-first in this path: it is written for the product in front of you, and it can be read against the Nigeria Data Protection Act without pretending to replace the Act.

This lesson is drafting literacy. It is not a template, and it is not advice for a client you have not met.

Build the notice from the map

Work in this order.

1. Who is speaking. The company name a user would recognise, and a contact that reaches a person.
2. What is collected. Taken from the dictionary. If location is collected, say location. If it is not, do not borrow a paragraph about location from a ride-hailing template.
3. Why each category exists. Tie the reason to a screen and a feature. “To improve our services” is not a reason a product manager can implement.
4. Who else receives it. Every SDK and API that gets a copy. The curriculum’s distinction matters: your client chose to collect, so they sit in the controller role; the SDK vendor is often a processor. If the notice is silent, the controller still has the problem.
5. How long. The period in the notice has to be the period in the purge job. A promise of three years that the database never enforces is a false notice. Lesson 2.5 is the technical half of this sentence.
6. Rights. A Nigerian user should be told, in ordinary language, how to ask for access, correction, and deletion, and what the company will do with that request. Check the current Act for the list you are prepared to stand on. Do not invent a right to sound modern, and do not omit one because a foreign template omitted it.
7. Cross-border storage. If the map shows a region outside Nigeria, say so. The source material points at section 41 of the NDPA for the transfer question. Confirm the section before a live draft quotes it. The literacy task is to stop hiding the region.
8. A human contact. Not a dead inbox.

What “functional” excludes

It excludes paragraphs about products the company does not run. It excludes “we may share data with trusted partners” when the partner is a named pixel you can see in the app. It excludes a retention sentence nobody has matched to a script.

When you have a draft, read it aloud next to the dictionary. Every noun in the draft should be a field, a vendor, or a purpose someone on the team can point at.