Most people discover that a company has been hacked through rumors, social media posts, or suspicious account activity long before they hear from the company itself. This article examines what businesses are actually required to do under Nigeria’s Data Protection Act when personal data is compromised and what rights individuals have when silence follows a breach