1.0 Introduction

First Power Electricity Distribution Limited (Firstpower Disco) is an electricity distribution company licensed by the Nigerian Electricity Regulatory Commission (NERC) to distribute electricity across its designated service areas.

Firstpower Disco collects a significant amount of information about our customers, vendors, and employees (data subjects). Some of this information is processed, stored electronically, and/or transmitted across networks to other systems. We recognize that personal data used for business activities must be secured, and it is our responsibility to ensure its confidentiality to maintain trust. Employees or third parties may have access to, handle, or process personal data concerning colleagues, customers, and vendors. It is essential that Firstpower Disco protects personal data and ensures compliance with the Nigeria Data Protection Regulation 2019 (NDPR). Breach of data security could result in business losses, lawsuits, and financial harm.

2.0 Definitions

• Firstpower Disco – First Power Electricity Distribution Limited

• NDPR – Nigeria Data Protection Regulation 2019

• Personal Data – Any data relating to an identified or identifiable natural person (data subject), such as name, address, photo, email address, or bank details.

• Data Subject – Any individual who can be identified, directly or indirectly.

• Data Subject Access Request – The formal process for individuals to request a copy of their personal data.

• DPO – Data Protection Officer

• Processing – Any operation performed on personal data, such as collection, storage, or transmission.

• Personal Data Breach – Any security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to personal data.

• Responsible Person – The person responsible for managing data within a department or the company.

3.0 General Provisions

• This policy applies to all personal data collected, stored, transmitted, and processed by Firstpower Disco.

• Our partners and vendors who process personal data on our behalf are required to adhere to this policy’s principles.

• Where applicable, Firstpower Disco will register with relevant authorities as an organization that processes personal data.

• Personal data will not be shared without proper authorization.

• Personal data will always be captured with the consent of the data subject, and such data will be encrypted when stored or transmitted electronically.

• Personal data will be processed in a secure environment by authorized personnel.

4.0 Policy Principles

Firstpower Disco is committed to processing data in accordance with its obligations under the Nigerian Data Protection Regulation (NDPR) and global data protection standards. This policy outlines Firstpower Disco’s commitment to ensuring that data storage and handling are carried out transparently and fairly, with respect for the rights of data subjects.

In line with the NDPR, Firstpower Disco follows these principles in the collection and processing of personal data:

• Personal data is processed based on the consent of the data subject, contractual obligations, legal requirements, vital interests, public interest, or legitimate business interests. Consent is obtained in a fair and lawful manner, free from fraud or coercion.

• Firstpower Disco collects personal data for specific, clear, and legitimate purposes, and these purposes are communicated to the data subjects.

• We only process adequate data necessary for the intended purposes.

• Firstpower Disco ensures that personal data is accurate and up to date. Inaccurate data will be rectified or erased promptly.

• Personal data will be retained only for the necessary period and for the specific purpose for which it was collected. Data may be stored longer for archiving, scientific, or historical purposes, subject to adequate security measures.

• When stored on paper, data will be secured and printouts will be securely shredded when no longer needed.

• When stored electronically, data will be protected from unauthorized access, accidental deletion, and malicious hacking.

4.1 Individual Rights

• Data subjects have the right to object to the use of their personal data for non-essential purposes.

• Data subjects may also request access to, amend, obtain a copy of, or delete personal data that is processed on their behalf, subject to applicable terms and conditions.

5.0 Lawful, Fair, and Transparent Processing

• All data processed by Firstpower Disco must have a lawful basis, including consent, contract, legal obligations, vital interests, public interest, or legitimate interests.

• Firstpower Disco will maintain a Register of Systems to ensure lawful, fair, and transparent data processing, and this register will be reviewed annually.

• Data subjects have the right to access their personal data, and any requests will be addressed in a timely manner.

• Where consent is the lawful basis for processing data, opt-in consent will be recorded, and systems will be in place to reflect any revocations of consent.

6.0 Monitoring

Firstpower Disco will monitor how personal data is collected, stored, processed, and transmitted in compliance with applicable regulations. In the event of a security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to personal data, Firstpower Disco will promptly assess the risk to individuals’ rights and freedoms and, if necessary, report the breach to relevant supervisory authorities within 72 hours.

7.0 Confidentiality

Firstpower Disco is committed to treating all personal data as strictly confidential, regardless of its form. The company will only use such information for the purposes for which it was provided and will ensure that its employees and subcontractors comply with this confidentiality obligation. However, Firstpower Disco may disclose confidential information if required by a court order or a relevant government authority. All employees, contractors, and third-party agents working with Firstpower Disco will be required to uphold this confidentiality commitment.