Nigeria Data Protection Commission (NDPC) 2025: Protecting Data in the Digital Age

If your operations involve the collection and processing of personal data such as students’ records, client information, patient details, customer data, or any other personal information, whether for commercial or non-commercial purposes, you are required to register as either a Data Controller or Data Processor.

Apply OSOPADEC Scholarship/Bursary Award 2025: Empowering the Youth

The Nigeria Data Protection Commission (NDPC) is the principal regulatory authority responsible for the enforcement of data protection and privacy laws in Nigeria. It was established to ensure compliance with data protection principles, regulate the processing of personal data, and promote the rights of individuals to data privacy.

The NDPC emerged as a direct response to the rising concerns over data breaches, cyber threats, and the need for Nigeria to align with global data protection standards, such as the European Union’s General Data Protection Regulation (GDPR).

The establishment of the NDPC is a significant step towards achieving data sovereignty and fostering trust in Nigeria’s digital economy.

Mandate of the NDPC:

• Regulation and Enforcement
• Data Privacy Awareness
• Policy Development
• Advisory Services
• International Cooperation

Regulatory Framework for Data Protection in Nigeria

The NDPC operates within a well-defined regulatory framework that governs data protection and privacy in Nigeria. The key components of this framework include:

Nigeria Data Protection Regulation (NDPR)

The Nigeria Data Protection Regulation (NDPR), issued in 2019, is the primary legal instrument for data protection in Nigeria. It outlines the principles and requirements for the collection, processing, storage, and transfer of personal data.

Key provisions of the NDPR include:

• Lawfulness of Data Processing: Personal data must be processed lawfully, fairly, and transparently.
• Data Minimization: Organizations should only collect data that is necessary for specific purposes.
• Data Subject Rights: Individuals have the right to access, rectify, and delete their personal data.
• Data Breach Notification: Organizations must notify the NDPC and affected individuals in the event of a data breach.

Cybercrimes (Prohibition, Prevention, Etc.) Act, 2015

This Act complements the NDPR by addressing cybercrimes, including identity theft, hacking, and data breaches. It provides penalties for cybercrimes and emphasizes the need for robust cybersecurity measures.

Freedom of Information Act (FOIA), 2011

The FOIA promotes transparency and accountability in government by granting individuals the right to access public information. The Act also emphasizes the need to protect sensitive personal data held by public institutions.

International Agreements

Nigeria’s data protection framework is aligned with international agreements and conventions, such as the African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention) and the ECOWAS Data Protection Act.