Can An Employer Access An Employee's Device?

 Introduction

In today's digital workplace, it is common for employers to provide employees with laptops and other electronic devices to facilitate the performance of their duties. Questions often arise, however, where an employee resigns unexpectedly, is suspended pending investigation, or is suspected of misconduct. Can the employer lawfully access the contents of a company-issued laptop without first obtaining the employee's consent?

Many employers assume that ownership of the device automatically entitles them to unrestricted access to everything stored on it. Nigerian law adopts a more nuanced approach. While ownership of the device is an important consideration, it does not, without more, confer an unlimited right to access all information stored on the device. The legal position requires a careful balance between an employer's legitimate business interests and an employee's constitutional right to privacy and data protection obligations.  

This update examines the legal framework governing an employer's access to companyissued computers under Nigerian law and highlights the practical considerations employers should bear in mind before accessing workplace devices without an employee's consent.

Ownership of the Device Does Not Mean Ownership of the Data

As a starting point, a company-issued laptop remains the property of the employer unless ownership has been transferred to the employee. Consequently, an employer is entitled to recover, maintain and secure the device, install security software, conduct system maintenance and protect corporate information stored on it.

However, ownership of the hardware does not automatically extend to every item of information stored on the device. Company-issued computers frequently contain both corporate information and employees' personal data, including private emails, photographs, medical information and financial records. While the device belongs to the employer, personal data stored on it remains protected under the Nigeria Data Protection Act, 2023 (NDPA).  

Accordingly, an employer's right of access must be exercised within the limits imposed by the Constitution, the NDPA and other applicable laws.

Employees Retain a Right to Privacy

Section 37 of the Constitution of the Federal Republic of Nigeria 1999 (as amended) guarantees the privacy of citizens, including the privacy of their correspondence and communications. Although the Constitution predates modern workplace technologies, its protections extend to electronic communications such as emails, electronic documents and instant messaging.

Importantly, however, the constitutional right to privacy is not absolute. Like many constitutional rights, it must be balanced against competing legitimate interests. Employers have legitimate interests in protecting confidential business information, investigating misconduct, maintaining cybersecurity, complying with regulatory obligations and safeguarding company assets. Consequently, the relevant legal question is not whether access interferes with privacy, it almost invariably will, but whether such interference is lawful, necessary and proportionate in the circumstances.  

Is Employee Consent Always Required?

 A common misconception is that an employer cannot access a company-issued computer without the employee's consent. That is not the position under Nigerian law.

Although consent is recognised as one of the lawful bases for processing personal data under Section 25 of the NDPA, it is only one of several lawful bases. Depending on the circumstances, an employer may rely on other recognised legal grounds, including:

• performance of a contract;
• compliance with a legal obligation;
• protection of vital interests;
• performance of a task carried out in the public interest; or
• the employer's legitimate interests.

In the employment context, the most relevant lawful basis will often be legitimate interest. This may justify access where necessary to investigate employee misconduct, respond to cybersecurity incidents, recover official documents, prevent fraud, protect confidential business information or ensure business continuity.

Accordingly, the absence of an employee's consent does not automatically render an employer's access unlawful. The critical question is whether the employer can demonstrate a lawful basis for the access and whether the access complies with the principles of necessity, proportionality and accountability under the NDPA.  

Lawful Access Does Not Mean Unlimited Access

Even where a lawful basis exists, an employer is not entitled to conduct an unrestricted search of a company-issued computer.

The NDPA and the General Application and Implementation Directive, 2025 (GAID 2025) require employers to comply with key data protection principles, including:

• Purpose limitation – access should be confined to the specific business purpose for which it is undertaken.
• Data minimisation – only information reasonably necessary for the investigation should be accessed.
• Fairness and transparency – employees should, wherever possible, be informed through employment contracts, staff handbooks or IT policies that company devices may be monitored or inspected.
• Proportionality – the extent of the search should correspond with the seriousness of the issue being investigated.

Employers should also distinguish between business information and purely personal data. While work-related documents and official communications will ordinarily fall within the employer's legitimate sphere of access, personal emails, photographs, medical records and financial information continue to enjoy statutory protection and should only be accessed where objectively necessary and legally justified.  

Practical Considerations for Employers

To minimise legal and regulatory risk, employers should consider the following measures:

• implement comprehensive IT, Acceptable Use and Data Protection Policies;
• clearly notify employees that company-issued devices may be monitored or inspected for legitimate business purposes;
• establish documented investigation procedures identifying when access is authorised;
• document the lawful basis for any proposed access, particularly where reliance is placed on legitimate interests;
• restrict access to authorised personnel and maintain audit trails;
• preserve the integrity of electronic evidence where litigation or disciplinary proceedings may follow; and
• ensure that all information obtained during any investigation is handled confidentially.

Conclusion

Whether an employer may lawfully access a company-issued computer without an employee's consent depends on the particular facts of each case. Ownership of the device, while important, is not determinative. Employers must be able to identify a lawful basis for the access, demonstrate that the access is necessary and proportionate, and ensure compliance with the constitutional right to privacy, the NDPA and applicable workplace policies.

Employers that adopt robust information technology and data protection policies, implement clear internal investigation procedures and carefully document their decisionmaking process will be better positioned to protect their business interests while remaining compliant with Nigeria's evolving data protection framework.  

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.