THE POWERS AND FUNCTIONS OF THE COMMISSION
The NDPC is the primary body empowered to oversee and implement the provisions of the NDPA. The specific functions of the Commission include:
1. The registration of major data controllers and data processors in the nation.[12] Thus an institution cannot carry on as a major data controller or processor without registering with the Commission.
2. Overseeing and regulating the use and deployment of technologies and structural processes in the enhancement of personal or sensitive data protection.[13]
3. Encourage and enhance the formulation and expansion of technologies for the protection of personal data in line with the relevant international legal framework and global practices.[14]
4. The promotion of public awareness and information on the understanding of data protection, the risks associated with the use of personal data, as well as the rights and obligations conferred by the Act.[15]
5. Receipt of complaints and grievances on the violations of the NDPA and the subsidiary legislations.[16]
6. The licensing, accreditation, and registration of persons under the appropriate framework, for the provision of data protection and NDPA compliance services.[17]
7. Ensuring compliance with the national and international framework for data protection as well as alignment with global best practices.[18]
8. Working in partnership with the necessary bodies, organisations, parastatals, agencies of government, ministries, or departments to foster and achieve the goals and objectives of the NDPA.[19]
9. Proffer advice and policy recommendations on all matters relating to data privacy and protection to the government.[20]
10. Participate in national conferences and represent the nation in international conferences and partnership programmes as well as liaise with relevant authorities on the development of an efficient system of regulating cross-border transfers of personal data.[21]
11. Assess and determine the existence and the extent of the adequacy of personal data protection standards for cross-border transfers, in the various regions and countries, corporate and business settings, contractual documents and codes of conduct of various bodies and organisations, etc.[22]
12. Submission of legislative proposals for the strengthening of personal data protection in Nigeria, to the Minister of Communications and Digital Economy.
13. Implement such other necessary actions for the performance of its function under the Act.
It is expedient to state that the exercise of the functions of the Commission is to be independent.[23] In order to facilitate and foster the execution of its functions stated above, the NDPA is empowered as follows:
1. To supervise the implementation of the NDPA.[24]
2. To prescribe payable fees for data controllers and processors in line with their data processing activities.[25]
3. To issue relevant rules, directives, policies and regulations in line with and for the purpose of the implementation of the provisions of the NDPA.[26]
4. To make provisions for compliance filings by major data controllers and processors to the Commission as well as the procedure and frequency of filing.[27]
5. To request for information from any person or authority, or call for the inspection of documents in respect of any act done under the NDPA.[28]
6. To carry out necessary investigations into an alleged breach of the provisions of the NDPA or its subsidiary legislations[29] and impose penalties for any found violation.[30]
7. To acquire, sell, lease or dispose of properties[31] and to exercise such other powers as are essential to give effect to its functions under the Act or any known law.[32]