Privacy Policy

PORT-HARCOURT ELECTRICITY DISTRIBUTION PLC

PRIVACY NOTICE
Effective Date: 9th June 2026

Port Harcourt Electricity Distribution Company PLC ("PHED", "the Company", "we", "our", or "us") is committed to protecting the privacy and personal data of our customers, employees, contractors, vendors, and other stakeholders in accordance with the Nigeria Data Protection Act (NDPA) 2023, applicable regulations, and our internal privacy and information security policies.

This Privacy Notice explains how we collect, use, disclose, transfer, store, and protect personal data, as well as the rights available to data subjects under applicable data protection laws.

1. Personal Data We Collect
We may collect and process personal data including, but not limited to:

Identification Information

• Full name
• Date of birth
• Gender
• Nationality
• Government-issued identification numbers
• Photographs and other identification records

Contact Information

• Residential or business address
• Telephone number
• Email address

Employment and Professional Information

• Employment history
• Job title and position
• Educational qualifications
• Professional certifications

Financial Information

• Bank account details
• Tax identification information
• Payment-related records

Digital and Technical Information

• IP address
• Device identifiers
• Access logs
• System usage information

Sensitive Personal Data
Where necessary and permitted by law, we may process sensitive personal data such as:

• Health information
• Biometric data
• Racial or ethnic origin
• Religious or philosophical beliefs
• Political opinions
• Other categories protected under applicable laws

2. Purpose of Processing Personal Data
PHED collects and processes personal data for the following lawful purposes:

• Compliance with the Nigeria Data Protection Act (NDPA) 2023 and other applicable laws and regulations.
• Management of employees, contractors, customers, vendors, and other business relationships.
• Provision and administration of electricity and related services.
• Contract administration and service delivery.
• Legal, regulatory, audit, and reporting obligations.
• Risk management, fraud prevention, and security monitoring.
• Protection of PHED's assets, systems, reputation, and operations.
• Protection of the vital interests of individuals.
• Fulfilment of statutory obligations to government agencies and regulators.
• Other legitimate business purposes consistent with this Privacy Notice.

3. Lawful Bases for Processing
PHED processes personal data based on one or more of the lawful bases recognized under the NDPA 2023:

• Consent of the data subject.
• Performance of a contract or steps taken prior to entering into a contract.
• Compliance with legal or regulatory obligations.
• Protection of vital interests of an individual.
• Legitimate interests pursued by PHED, provided such interests do not override the rights and freedoms of the data subject.
• Performance of a task carried out in the public interest or under official authority, where applicable.

4. Sharing and Disclosure of Personal Data
 PHED may disclose personal data to the following categories of recipients:

a.      Government and Regulatory Authorities
Government Ministries, Departments, Agencies, regulators, and supervisory authorities where required by law or regulatory obligations.

b.     Data Processors and Service Providers
Authorized vendors, contractors, consultants, and service providers who process data on our behalf and are contractually bound by confidentiality and data protection obligations.

c.     Third-Party Partners
Third parties involved in providing employment-related, contractual, statutory, or business services.

d.      Law Enforcement Agencies and Courts
Where disclosure is required by applicable law, court order, or lawful request.

e.      Emergency Services
Where necessary to protect life, safety, or vital interests.

f.      Cross-Border Transfers
Where personal data is transferred outside Nigeria, such transfers shall be carried out in accordance with NDPA requirements, including adequacy decisions, contractual safeguards, or other lawful transfer mechanisms.

5. Data Subject Rights
Under the Nigeria Data Protection Act (NDPA) 2023, you have the right to:

• Request access to your personal data.
• Request information about how your personal data is processed.
• Request correction of inaccurate or incomplete personal data.
• Request deletion of personal data in certain circumstances.
• Restrict or object to processing.
• Request data portability where applicable.
• Withdraw consent at any time where consent is the basis for processing.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC).

Requests relating to these rights may be submitted through the contact details provided below.

6. Data Retention
PHED retains personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with legal, regulatory, contractual, and operational requirements.

Upon expiration of applicable retention periods, personal data will be securely deleted, anonymized, or otherwise disposed of in accordance with established records management and data protection procedures.

7. Data Security and Safeguards
PHED implements appropriate technical, organizational, administrative, and physical security measures designed to protect personal data against:

• Unauthorized access
• Loss or theft
• Misuse
• Alteration
• Accidental disclosure
• Destruction or damage

We continuously review and enhance our security controls to maintain the confidentiality, integrity, and availability of personal data.

8. Accountability and Governance
To demonstrate accountability and compliance with applicable data protection laws:

• PHED has appointed a Data Protection Officer (DPO) responsible for overseeing data protection compliance activities.
• Employees handling personal data receive periodic privacy and information security awareness training.
• Data processing activities are documented and maintained in accordance with regulatory requirements.
• Periodic compliance reviews and audits are conducted to assess and improve data protection practices.
• Appropriate governance structures are maintained to support privacy compliance and risk management.

9. Contact Information
If you have any questions, concerns, requests, or complaints regarding this Privacy Notice or the processing of your personal data, please contact:

Data Protection Officer (DPO)
Port Harcourt Electricity Distribution PLC (PHED)
1 Moscow Road, Port Harcourt, Rivers State, Nigeria
Name: Mr. Osio Oreva Samuel
Telephone: +234 703 706 9977
Email: osio.oreva@phed.com.ng