Data Privacy Policy 

Introduction

Port Harcourt Electricity Distribution Plc’s (PHED) needs to gather and use certain information about individuals.

These can include customers, suppliers, business contacts, employees, and other people the organisation has a relationship with or may need to contact.

This policy describes how this personal data must be collected, handled, and stored to meet the company’s data protection standards — and to comply with the law.

This Data Protection and Privacy Policy (the “Policy”) informs our customers and the public (hereinafter referred to as “you”, “your” or “data subject”) as to how we use and look after your personal data, your privacy rights and how we plan to protect them.

Any reference to "we", "us", "our" and “the Company” is to PHED.

Why this policy exists

This data protection policy ensures PHED:

 

Data protection law

The Nigerian Data Protection Regulation 2019 describes how organisations — including PHED— must collect, handle and store personal information.

These rules apply regardless of whether data is stored electronically, on paper or on other materials.

To comply with the law, personal information must be collected and used fairly, stored safely and not disclosed unlawfully.

The Nigerian Data Protection Regulation states that personal data must:

  1. Be processed fairly and lawfully
  2. Be obtained only for specific, lawful purposes
  3. Be adequate, relevant and not excessive
  4. Be accurate and kept up to date
  5. Not be held for any longer than necessary
  6. Processed in accordance with the rights of data subjects
  7. Be protected in appropriate ways

People, risks and responsibilities

Policy scope

This policy applies to:

It applies to all data that the company holds relating to identifiable individuals, even if that information technically falls outside of the Nigerian Data Protection Regulation 2019. This can include:

 

Data protection risks

This policy helps to protect PHED from some very real data security risks, including:

 

Data Protection Principles 

In keeping and processing your data, PHED in compliance with all the relevant laws and regulations will ensure your personal data

 

Data use

Personal data is of no value to PHED unless the business can make use of it. PHED will use your personal information for billing purposes, regulatory reporting & compliance, dispute resolution & advisory purposes, execution of contractual obligations, communication purposes, debt recovery and any business-related purpose.

 

Data Security

  1. PHED shall ensure that personal data is stored securely using modern software that is kept up to date. 
  2. Access to personal data shall be limited to personnel who need access and appropriate security should be in place to avoid unauthorised sharing of information.
  3. When personal data is deleted this should be done safely such that the data is irrecoverable.
  4. Appropriate back-up and disaster recovery solutions shall be in place.

 

Data Retention

PHED will only keep your personal data for the duration of the time it provides services to you.

Data that is no longer needed will be deleted. If this is not possible in the case where personal information has been stored in back up archives, the data will be securely stored and isolated from any other processing for 5 years when it is then deleted.

 

Data Collection

PHED collects personal information that is voluntarily provided to us by individuals when express interest is shown in our products and services.

The personal information collected from individuals depends on the perspective of the dealings with PHED and the services chosen by the individual. The personal information that could be collected are:

 

Subject access requests

All individuals who are the subject of personal data held by PHED are entitled to:

If an individual contacts the company requesting this information, this is called a subject access request.

Subject access requests from individuals should be made by email, addressed to the data controller at dpo@phed.com.ng The data controller can supply a standard request form, although individuals do not have to use this.

The data controller will always verify the identity of anyone making a subject access request before handing over any information.

 

Disclosing data for other reasons

In certain circumstances, the Nigerian Data Protection Regulation allows personal data to be disclosed to law enforcement agencies without the consent of the data subject.

Under these circumstances, PHED will disclose requested data. However, the data controller will ensure the request is legitimate, seeking assistance from the board and from the company’s legal advisers where necessary.

 

Providing information

PHED aims to ensure that individuals are aware that their data is being processed, and that they understand:

To these ends, the company has a privacy statement, setting out how data relating to individuals is used by the company.

 

Contact

If you have any question or comment about this Policy, you may contact our Data Protection Officer (DPO) via this email address: dpo@phed.com.ng