Your Site Is Live. Is It Legal?

The compliance documents every website and mobile app needs, and what happens when you skip them

You spent weeks on the design. The animations are smooth, the load time is under two seconds, the copy finally sounds right. You push it live and it looks brilliant.

Then a user emails asking what you did with their data. Or Apple rejects your app three days before launch. Or a regulator sends a letter with your company name on it.

None of that is about your code. It is about a handful of documents most people treat as an afterthought, copied from some other site at the last minute and buried in the footer.

Here is the thing worth knowing early: those documents are not decoration. They are the difference between a product that can operate and one that cannot. And enforcement is no longer a distant European problem. In Nigeria, the Data Protection Commission has already issued a fine of 220 million dollars against Meta and 766.2 million naira against MultiChoice Nigeria. This is happening here, at home, right now.

Let us walk through what you actually need.

First, a better way to think about it

Compliance is not one file you upload once and forget. It is a small stack of documents, and which ones you need depends on three simple questions:

1. What data do you collect? Names, emails, IP addresses, location, payment details, anything.
2. Who are your users? Someone in Lagos, someone in London, and someone in California are protected by three different laws.
3. Where do you publish? A website has one set of rules. An app store adds a whole extra gate.

Answer those three honestly and the rest of this becomes straightforward.

The privacy policy: the one you cannot skip

If your site or app collects any personal information at all, you need a privacy policy. And “any” is broader than most people realise. A contact form counts. A newsletter signup counts. Google Analytics counts, because it collects IP addresses. If you have any of those, you are collecting personal data.

A privacy policy that actually does its job explains:

• What you collect. Be specific. Names, emails, device identifiers, cookies, payment information.
• Why you collect it. Analytics, order fulfilment, marketing, improving the service.
• Your legal basis for collecting it. This one gets skipped constantly and regulators notice.
• Who you share it with. Every analytics tool, payment processor, email platform, and embedded widget on your site is a third party receiving data.
• How long you keep it. Vague promises are not good enough.
• What rights users have. Access, correction, deletion, and how to actually exercise those rights.
• How to reach you. A real, working contact route.

Two practical notes. Host it at a predictable URL like yoursite.com/privacy-policy, and if you have both a website and an app, the policy must cover the app specific data too, things like device identifiers, push notification tokens, and mobile analytics. A web only policy attached to an app is an incomplete policy.

Terms of service: the rulebook

Where the privacy policy is about data, terms of service is about the relationship between you and your user. It is the document that saves you when a user does something you never anticipated.

Good terms cover what your service does and does not promise, what counts as acceptable use, who owns the content and intellectual property, how accounts get suspended or closed, how you limit your liability, and which country's law governs any dispute.

Nobody reads it until something goes wrong. Then everybody reads it very carefully.

Cookies and consent: where most sites quietly fail

If you run analytics, advertising pixels, or embedded widgets, you are using cookies, and cookies come with rules of their own.

Under GDPR, consent has to be a genuine yes. That means:

• Opt in, not opt out. Cookies cannot fire before the user agrees. Loading trackers on arrival and offering a settings menu afterwards is a violation, not a compromise.
• No pre ticked boxes. Silence and inactivity do not count as consent.
• Refusing must be as easy as accepting. If “Accept All” is a bright button and declining is buried three clicks deep, that is a design problem with legal consequences.
• No cookie walls. You cannot lock basic functionality behind acceptance.
• Granular where possible. Users should be able to accept analytics but refuse marketing.

Regulators have moved well past warnings on this. France's data protection authority fined Google 325 million euros in 2025 over cookie consent practices, and a much smaller company was fined 1.5 million euros simply for dropping advertising cookies before users had a chance to respond to the banner.

The banner alone is not compliance. What the banner actually does is compliance.

Selling something? Add these

If money changes hands, you need clear terms of sale covering pricing, what is included, delivery timelines, refund and return conditions, cancellation rights, and how disputes get resolved. Consumers are entitled to know these things before they pay, not after they complain.

If you give advice of any kind, whether financial, medical, legal, or fitness related, add a disclaimer. Same goes for affiliate links and any earnings claims.

The extra gate: publishing a mobile app

This is where founders get blindsided. You can build a flawless app and still be stopped at the door.

Apple requires a live, publicly accessible privacy policy URL in App Store Connect. It must not sit behind a login. You must also complete App Privacy labels declaring what data you collect, and if your app creates accounts, you must let users delete those accounts from inside the app. Apps using external AI services now have to disclose that too.

Google Play requires a privacy policy for any app requesting sensitive permissions such as camera, location, contacts, microphone, or storage. You also complete a Data Safety section in the Play Console.

Now the part that catches people out. Both stores compare three things: what your app actually does, what your labels declare, and what your privacy policy says. If those three do not agree, you get rejected. Repeat mismatches can get a live listing pulled.

So the labels are not a form to rush through. They are a public statement about your data practices, and public statements are enforceable well beyond the app store.

The law at home: Nigeria's Data Protection Act

If you are building for Nigerian users, this is the one closest to you.

The Nigeria Data Protection Act 2023 came into force on 12 June 2023, replacing the old NDPR and creating the Nigeria Data Protection Commission as a regulator with real enforcement powers. The Commission's General Application and Implementation Directive, which spells out how to comply in practice, has been in effect since September 2025.

What it asks of you in plain terms:

• Process data fairly, lawfully, and transparently.
• Collect only for specific, legitimate purposes, and do not quietly repurpose it later.
• Have a lawful basis for what you are doing, and get consent that is informed, specific, freely given, and unambiguous.
• Publish a privacy policy people can find and understand.
• Sign data processing agreements with anyone processing data on your behalf.
• Run impact assessments before high risk processing.
• Register with the NDPC and appoint a data protection officer if you qualify as a data controller of major importance, which can apply once you process the data of more than 200 people within six months.
• Document your basis and safeguards before moving personal data outside Nigeria.

Penalties reach the greater of 2 percent of annual gross revenue or 10 million naira, with criminal exposure for wilful violations.

The 200 person threshold deserves a second look, because a modest Nigerian startup with a mailing list can cross it faster than expected.

And if you have users in Europe: GDPR

GDPR applies based on where your users are, not where your company is. If people in the EU can use your product, it reaches you in Abuja just as it reaches a company in Berlin.

The core of it: every processing activity needs a lawful basis, privacy information must be in clear plain language, and users have real, enforceable rights to access, correct, delete, and port their data. Fines run up to 20 million euros or 4 percent of global annual turnover, whichever is higher.

Many Nigerian businesses assume this is somebody else's problem. If you have a single European client, or a signup form the whole internet can reach, it is your problem too.

The mistakes that keep catching people

• Generic templates. A policy copied from another site describes that site's data practices, not yours. Regulators compare the document against what your product actually does.
• The document says one thing, the product does another. This is the single fastest route to a rejection or a fine.
• Set and forget. You added a new analytics tool, a chatbot, a payment provider. Your policy did not change. It is now inaccurate.
• Treating the app like the website. An app collects device level data a website never touches. It needs its own coverage.
• Design that manipulates the choice. Regulators now look at the actual user experience, not just the legal text. A banner engineered to push acceptance is a finding waiting to happen.

So what do you actually need?

Use this as a starting point, not a verdict. A simple brochure site with no forms sits at the light end. The moment you add a signup form, analytics, payments, or an app, you move up the stack quickly.

The honest summary

Compliance is not paperwork you do to keep lawyers happy. It is what lets you enter markets, pass app review, close enterprise deals, and tell users something true about how you treat them. Skipping it does not save time. It moves the cost to a worse moment, usually the week you launch.

Start here: write down every piece of data your product touches and every third party tool that sees it. That single list is the foundation of every document above. Once you have it, none of this is mysterious.

A necessary note

This article is educational. It is a solid foundation, not legal advice, and it cannot account for the specifics of your business, your users, or your jurisdiction.

If you need advice on your actual situation, speak to a lawyer who can look at your product properly. Ochasi Darlington, founder of Zenith Forge, is a qualified Nigerian lawyer and can advise you directly. Reach out through the contact form and we will take it from there.

That is the part most tech companies cannot offer you. We build the product, and we can stand behind the compliance too.