Compliance
NDPR Compliance & Data Security
Strict compliance with the Nigeria Data Protection Regulation (NDPR). Protecting the identity, biometrics, and financial details of 65,000+ civil servants.
As a custodian of massive public sector records, the Anambra State Government prioritizes secure data processing. The Anambra State Enterprise Payroll System (ASEPS) has been architected from the ground up to fulfill all statutory requirements under the **Nigeria Data Protection Regulation (NDPR)** and the **Nigeria Data Protection Act (NDPA)**.
Data Protection Architecture
Column-Level Envelope Encryption
Highly sensitive personal identification items—such as National Identification Numbers (NIN), Bank Verification Numbers (BVN), bank account codes, and biometric facial blobs—are isolated and encrypted at the column level within PostgreSQL using AES-256-GCM envelope encryption.
Quarterly Key Rotation
Data keys are dynamically generated, managed through secure AWS Key Management Service (KMS), and rotated quarterly. Historic records are re-encrypted automatically during rotation periods with zero platform downtime.
Immutable Audit Trail
All data access events (decryptions, lookups, exports, edits) are compiled in an append-only transaction ledger. This database is hashed hourly and replicated asynchronously to read-only AWS S3 Glacier buckets with a strict 7-year retention policy.
Data Subject Rights & Self-Service
Under the NDPR guidelines, every civil servant whose records reside within the ASEPS registry holds explicit rights regarding their data. The platform facilitates these rights through:
- ▪Right to Information: Complete transparency of salary slip items, allowances, and structural deductions via the employee login dashboard.
- ▪Right to Correction: Administrative pipelines allowing employees to request bank account or biometric updates through verified MDA coordinators (requiring NIMC verification and multi-step reviews).
- ▪Right to Access Audit: A log of every administrative query concerning an employee’s profile, ensuring audits can verify the legitimacy of data reviews.
In closing