Your Data, Your Rights: A Closer Look at Nigeria’s Data Privacy and Protection Regulations

Privacy and Data Protection Law in Nigeria

Have you ever been called by an unknown person claiming to be from your bank or other service providers in Nigeria, and it turned out to be a scam? Do you wonder how they got your name, phone number, and even the correct date of birth? That can be a result of data compromise or poor data protection practices by data processors. (organizations that collect, process, store, and share the personal data of their clients or customers, either private or public)

In November 2022, the Federal Government of Nigeria issued a service-wide circular directing all Ministries, departments, and Agencies (MDAs) of government to comply with the Nigeria Data Protection Regulation (NDPR) provisions. The regulation was a subsidiary piece of legislation that derived its powers from the NITDA Act of 2007, with specific reference to Section 6. Babatunde Bamigboye Esq., Head, of Legal Enforcement and Regulations at the Nigeria Data Protection Bureau, said the circular was signed by the then Secretary to the Government of the Federation, Mr. Boss Mustapha.

Experts in the sector were not satisfied with the regulation, citing various reasons, including the need for a more comprehensive law with encompassing powers. There were therefore concerted efforts to have the Data Protection Bill signed into law by former President Muhammadu Buhari, but that did not happen. So when the Bill was recently signed into Law by President Bola Ahmed Tinubu on June 12, 2023, it came as a sign of relief to most of us.

Why Nigeria Needs Data Privacy and Protection Regulation

Data protection regulations guarantee strong protection for individuals regarding their personal data and apply to businesses that collect, use, or share personal data, irrespective of the source of information. So nobody is going to get access to your data through the backdoor and try to use it against you, such as through scams and identity theft.

With the increasing digitization of personal, financial, and sensitive information, there’s a growing risk of unauthorized access, breaches, and misuse of data. Regulations are essential to safeguarding individuals’ digital identities.

It also fosters trust in the digital ecosystem, enabling secure data flows, and promoting responsible data handling in Nigeria’s rapidly evolving digital landscape.

The Data Protection Act (DPA) is important legislation that takes Nigeria a step towards enhancing data protection practices in the country and aligning with international standards. It underscores the importance of responsible data handling, transparency, and individual rights within the digital landscape.

How the Regulations Apply to Nigerians

The Data Protection Act holds immense significance for Nigerians in today’s interconnected digital landscape. According to the Data Portal, there were 122.5 million internet users in Nigeria in January 2023. Nigeria’s internet penetration rate stood at 55.4 percent of the total population at the start of 2023.

It has become almost impossible to make use of the internet without giving out personal and sensitive information. There are now hundreds of applications, websites, and online service providers that require sensitive and personal information from Nigerians. They include digital banks and loan applications, social media platforms, survey agencies, telecom companies, marketing and advertising agencies, airlines, hotels, travel agencies, cloud storage providers, and software-as-a-service platforms, which may collect personal data as part of their user registration and service provision.

The regulation, therefore, ensures that the data is properly sourced, stored, and safeguarded by the data processors. So, when next you get a phone call from an unknown person who has possession of your personal or sensitive data, be aware that someone or an organization has failed to abide by the provisions of the Nigerian Data Protection Act.

Nigeria’s data protection regulations now require data processors to implement appropriate systems and processes to ensure adequate protection of personal data and the rights of individuals. The regulation mandates organizations to take the following procedures, among others:

1. Create and maintain an organizational policy for handling personal data (as well as any sensitive or confidential data), which must be publicized on every medium where personal data is collected or processed.

2. Train their staff on data protection laws, practices and processes

3. Employ or appoint a Data Protection Officer who will be responsible for adherence to the regulation, relevant data privacy instruments and data protection directives of the organisation; and

4. Develop and maintain security measures, such as securing systems from hackers, setting up firewalls, securing storage of data with access restricted to specifically authorized individuals, deployment of data encryption technologies, protecting emailing systems, etc, to protect data;

5. Implement a data processing agreement with third-party data processors.

Adanu Moses

I am an experienced strategic Communication professional

proficient at utilizing multiple communication tools to help organizations meet their goals and provide exceptional service