1. Institutional Data Controller & Scope
The South-South Development Commission (SSDC) (“the Commission”, “we”, “us”, or “our”), established pursuant to the South-South Development Commission (Establishment) Act, 2025, is the statutory Data Controller responsible for personal and institutional information processed through this official portal (ssdc.gov.ng), regional telemetry systems, procurement registries, and stakeholder engagement desks across Akwa Ibom, Bayelsa, Cross River, Delta, Edo, and Rivers States.
This Privacy Policy governs how the Commission collects, processes, stores, shares, and safeguards personal data in accordance with the Nigeria Data Protection Act (NDPA) 2023 and directives of the Nigeria Data Protection Commission (NDPC).
2. Categories of Personal & Institutional Data We Collect
Depending on how you interact with the Commission, we process only the minimum data necessary for legitimate public-interest execution:
- Strategic Partnership & Co-Investment Inquiries: Organization name, principal contact full name, designation, official email address, telephone number, target development pillar, and project proposal summaries submitted via our Partner Portal.
- Public Procurement & Vendor Prequalification Records: Corporate Affairs Commission (CAC) registration particulars, Tax Identification Numbers (TIN), PENCOM/ITF/NSITF compliance certificates, BPP National Database identifiers, and key personnel professional accreditations (COREN, ICAN, NBA, etc.).
- Citizen & Community Feedback Telemetry: Voluntarily submitted community feedback regarding regional infrastructure, environmental remediation, or social empowerment projects across the 123 Local Government Areas of the South-South zone.
- Technical & Security Log Data: Anonymized IP routing metadata, browser user-agent strings, request timestamps, and security firewall logs used strictly to protect sovereign digital infrastructure against unauthorized access or cyber-intrusion.
3. Lawful Basis & Statutory Mandate for Processing
Under Section 25 of the Nigeria Data Protection Act (NDPA) 2023, SSDC processes personal data on the following lawful bases:
- Exercise of Public Authority & Statutory Mandate: Processing necessary for executing our functions under Section 8 of the SSDC Establishment Act, 2025, including regional master planning, infrastructure delivery, and socio-economic development across the six member states.
- Compliance with Legal Obligations: Fulfilling mandatory vetting under the Public Procurement Act, 2007, Bureau of Public Procurement (BPP) guidelines, Fiscal Responsibility Act, and anti-money laundering regulations.
- Explicit Consent: Where you voluntarily submit a partnership inquiry, subscribe to official dispatches, or configure optional preferences via our Cookie Notice.
4. Inter-Agency Sharing & Procurement Transparency
The Commission does not sell, lease, or commercially trade personal data under any circumstances. Data may be shared strictly on a statutory need-to-know basis with:
- Federal Regulatory & Sister Authorities: The Bureau of Public Procurement (BPP), Office of the Auditor-General for the Federation, Nigeria Revenue Service (NRS), and sister agencies (NDDC, NCDMB, NIMASA, TETFUND) for joint programme verification.
- Member State Governments: Designated Ministries, Departments, and Agencies (MDAs) of Akwa Ibom, Bayelsa, Cross River, Delta, Edo, and Rivers States where co-investment or corridor alignment requires joint technical review.
5. Sovereign Data Security & Retention Standards
SSDC enforces multi-layered cryptographic security (TLS 1.3 encryption in transit, role-based access control, and continuous intrusion monitoring) across all portal endpoints. Records relating to public procurement and capital projects are retained in accordance with Federal Civil Service archival schedules and the Public Procurement Act, 2007, after which non-statutory personal data is securely expunged.
6. Your Rights Under the Nigeria Data Protection Act (NDPA) 2023
As a Data Subject under Nigerian law, you are entitled to exercise the following rights free of charge:
- Right of Access & Rectification: Request confirmation of the personal data SSDC holds about you and require correction of any inaccurate or incomplete records.
- Right to Erasure & Restriction: Request deletion or restriction of personal data where processing is no longer required by statutory public-interest obligations.
- Right to Withdraw Consent: Withdraw previously granted consent for optional communications at any time.
- Right to Lodge a Complaint: Escalate any unresolved data privacy concern to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
7. Contact the Commission Data Protection Officer (DPO)
All inquiries, subject access requests, or statutory notices regarding data protection should be directed to the Data Protection Unit within the Directorate of Corporate Services: