Effective Date:01/03/2026
Last Updated: 01/03/2026

1. Purpose and Scope

This Data Protection Compliance Addendum (“Addendum”) establishes the framework under which the National Association of Polytechnic Students (NAPS) North Central Zone (“NAPS North Central,” “the Zone,” “we,” or “our”) ensures lawful, transparent, and accountable processing of personal data.

This Addendum supplements our Privacy Policy and applies to:

• Zonal executives and committees

• Institutional representatives

• Program coordinators

• Volunteers and staff handling personal data

• Third-party vendors or partners processing data on our behalf

It governs all personal data collected, processed, stored, transmitted, or otherwise handled by NAPS North Central in the course of its operations.

2. Definitions

For the purpose of this Addendum:

• Personal Data means any information relating to an identified or identifiable individual.

• Data Subject refers to the individual whose personal data is processed.

• Processing includes collection, recording, storage, use, transmission, disclosure, or deletion of personal data.

• Data Controller refers to NAPS North Central when determining the purpose and means of processing.

• Data Processor refers to any third party processing personal data on behalf of NAPS North Central.

2. Governing Principles of Data Processing

NAPS North Central commits to processing personal data in accordance with the following principles:

3.1 Lawfulness, Fairness, and Transparency

Data shall be processed lawfully, fairly, and in a transparent manner.

3.2 Purpose Limitation

Personal data shall be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.

3.3 Data Minimization

Only data necessary for the stated purpose shall be collected and processed.

3.4 Accuracy

Reasonable steps shall be taken to ensure personal data is accurate and up to date.

3.5 Storage Limitation

Personal data shall not be retained longer than necessary.

3.6 Integrity and Confidentiality

Appropriate technical and organizational measures shall be implemented to safeguard data against unauthorized access, loss, alteration, or disclosure.

4. Lawful Basis for Processing

NAPS North Central processes personal data under one or more of the following lawful bases:

• Consent of the data subject

• Performance of official organizational functions

• Legitimate interests of student governance and advocacy

• Compliance with legal or regulatory obligations

Where consent is required, it shall be obtained explicitly and may be withdrawn at any time.

5. Roles and Responsibilities

5.1 Zonal Coordinator

The Zonal Coordinator bears overall responsibility for ensuring institutional compliance with data protection obligations.

5.2 Executive Officers and Committees

Executives and committee members handling personal data must:

• Process data strictly within authorized scope

• Maintain confidentiality

• Report suspected breaches immediately

5.3 Data Processors (Third Parties)

Third-party service providers must:

• Enter into written agreements governing data processing

• Implement appropriate security safeguards

• Process data only under documented instructions

6. Data Subject Rights

Data subjects whose information is processed by NAPS North Central have the right to:

• Access their personal data

• Request correction of inaccurate information

• Request deletion where applicable

• Restrict or object to processing

• Withdraw consent where processing is based on consent

• Request clarification on how their data is used

Requests shall be addressed within a reasonable timeframe and subject to applicable limitations.

7. Data Security Measures

NAPS North Central implements reasonable administrative and technical safeguards, including:

• Access control restrictions

• Password-protected systems

• Secure document storage

• Limited data access on a need-to-know basis

• Periodic review of stored information

Sensitive data shall receive enhanced protection measures.

8. Data Breach Management

In the event of a suspected or confirmed data breach:

1. The incident shall be documented immediately.

2. Internal investigation shall be conducted promptly.

3. Affected data subjects shall be notified where necessary.

4. Remedial actions shall be implemented to prevent recurrence.

All executives must report potential breaches without delay.

9. Data Retention and Disposal

Personal data shall be retained only for:

• Duration necessary to fulfill stated purposes

• Legal or institutional reporting requirements

• Archival or historical documentation (where appropriate)

Secure disposal methods shall be applied to obsolete records, including digital deletion and physical shredding where applicable.

10. Cross-Border Data Transfers

Where personal data is processed or stored outside immediate institutional systems (e.g., cloud services), NAPS North Central shall ensure that:

• Adequate data protection safeguards are in place

• Service providers maintain appropriate security standards

11. Training and Awareness

NAPS North Central shall promote periodic data protection awareness among:

• Zonal executives

• Committee members

• Program coordinators

This ensures responsible handling of personal data across all operational levels.

12. Monitoring and Compliance Review

Compliance with this Addendum shall be periodically reviewed to ensure:

• Continued alignment with legal standards

• Adequacy of safeguards

• Responsiveness to emerging data protection risks

Non-compliance may result in disciplinary action consistent with organizational policies.

13. Relationship with Other Policies

This Addendum must be read in conjunction with:

• Privacy Policy

• Terms of Use

• Code of Conduct

• Media & Documentation Guidelines

In the event of conflict, the stricter data protection standard shall apply.

14. Amendments

NAPS North Central reserves the right to update this Addendum to reflect operational, technological, or legal changes. Updated versions shall be published with a revised effective date.

15. Contact for Data Protection Matters

For data protection inquiries, requests, or complaints:

NAPS North Central Zone
Office of the Zonal Coordinator

Student Union Government Secretariat, Federal Polytechnic Nasarawa, Nasarawa State, Nigeria.
helpdesk@napsnorthcentral zone.com.ng
234 707 232 1033
www.napsnorthcentralzone.com.ng

Declaration of Commitment

NAPS North Central Zone affirms its unwavering commitment to responsible data governance, confidentiality, and ethical stewardship of personal information entrusted to it in the course of serving Polytechnic students across the North Central Zone.