CONTRIBUTOR: FAVOUR SOMTO NWACHUKWU
Introduction
Data has become one of the most valuable resources in the global economy. Governments, corporations, and private entities increasingly rely on data to drive innovation, governance, and commercial decision-making. However, the expansion of data processing activities has heightened the risks of privacy violations, identity theft, cybercrime, and unauthorised surveillance.
This development raises critical questions: who is responsible for protecting such data? What are the consequences when data is leaked, stolen, or misused? What legal obligations arise when organisations process personal information?
Accordingly, data protection, privacy, and cybersecurity have become central legal concerns. In Nigeria, the protection of personal data is grounded in constitutional guarantees, statutory frameworks, and regulatory oversight. The Nigeria Data Protection Act 2023 (NDPA) marks a significant milestone in establishing a comprehensive legal regime governing the processing, storage, and protection of personal data. This article examines the legal responsibilities imposed on data controllers and processors in Nigeria within the broader framework of privacy rights and cybersecurity obligations.
Understanding the Terminologies in Data Protection
- Personal Data
Personal data means any information relating to an individual who is identified or identifiable, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, psychological, cultural, social, or economic identity of that individual.[1]
- Data Protection[2]
Data protection refers to the legal and regulatory framework governing the collection, processing, storage, and transfer of personal data, ensuring that individuals are protected against misuse or unauthorised access. It encompasses the strategic and procedural measures adopted to ensure the privacy, availability, and integrity of personal data and is often used interchangeably with the term ‘data security’. These principles impose obligations on organisations that collect and process personal data to ensure that such data is protected against unauthorised access, disclosure, or misuse.[3]
- Data Privacy
Data privacy refers to the proper handling of personal data to uphold an individual’s privacy rights. It involves the collection, storage, use, and sharing of personal information securely and ethically, ensuring that sensitive data is protected against unauthorised access or misuse.[4]
- Cybersecurity
Cybersecurity refers to the protection of computer systems, networks, and electronic data from unauthorised access, attack, damage, or disruption. It encompasses the technologies and practices that safeguard computer systems and electronic data.[5] In Nigeria, cybersecurity continues to evolve in response to growing threats such as ransomware, phishing, and financial fraud, driven by a rapidly expanding digital economy. The key legal frameworks regulating cybersecurity in Nigeria include the Cybercrimes (Prohibition, Prevention, etc.) Act 2015 and NDPA, with oversight provided by the Nigeria Data Protection Commission (NDPC), the National Information Technology Development Agency (NITDA), and the Central Bank of Nigeria.
- Right to Privacy
The right to privacy is widely recognised as a fundamental human right and refers to individuals’ right to control information about their personal lives. In Nigeria, this right is constitutionally guaranteed. Section 37 of the Constitution of the Federal Republic of Nigeria 1999 (CFRN as amended) protects the privacy of citizens, their homes, correspondence, telephone conversations, and telegraphic communications.[6]
Legal and Regulatory Framework Guiding Data Protection in Nigeria
- The 1999 Constitution[7]
The legal foundation for data protection in Nigeria is rooted in the constitutional right to privacy under Section 37 of the CFRN. This provision guarantees and protects the privacy of citizens, their homes, correspondence, telephone conversations, and telegraphic communications.
Section 37 provides:
“The privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications is hereby guaranteed and protected.”
In Digital Rights Lawyers Initiative v National Identity Management Commission[8], the Court of Appeal upheld the decision of the lower court that the right to privacy under section 37 of the CFRN includes the protection of personal information and data. The court further held that the scope and limitations of the fundamental rights guaranteed in Chapter IV of the CFRN are to be understood in light of relevant statutes, laws, and regulations.
- The Nigeria Data Protection Act 2023
The NDPA is the principal legislation regulating the collection, processing, and use of personal data in Nigeria. The Act establishes the NDPC, which is empowered to regulate and oversee data protection practices.
The Commission is mandated to regulate the deployment of technological and organisational measures to enhance personal data protection; foster the development of data protection technologies in accordance with recognised international best practices and applicable international law; accredit, license, and register suitable persons to provide data protection compliance services; register data controllers and data processors; and promote awareness of the obligations of data controllers and data processors under the Act.
- The Cybercrimes (Prohibition, Prevention, etc.) Act 2015
Cybersecurity constitutes an integral component of data protection. Accordingly, organisations that process personal data are required to implement robust cybersecurity measures to prevent unauthorised access and cyberattacks.
The Cybercrimes (Prohibition, Prevention, etc.) Act 2015 provides the legal framework for combating cyber offences such as hacking, identity theft, phishing, and data interference. The Act imposes obligations on service providers and institutions to retain traffic data and cooperate with law enforcement authorities in cybercrime investigations.
Sections 6 and 9 of the Cybercrimes (Prohibition, Prevention, etc.) Act 2015 prohibits unauthorised access to computer systems for the purpose of extracting information, manipulating data, misdirecting electronic messages, or intercepting electronic communications.[9] Similarly, sections 22 to 25 address offences such as identity theft, unsolicited messages, the dissemination of false, embarrassing, or harmful information about individuals, and consumer fraud.[10]
- The National Information Technology Development Agency Regulation
The NITDA Regulation, made pursuant to the NITDA Act, empowers the Agency to make policies and guidelines for the protection of data and to monitor the use and exchange of data.[11] This authority is derived from section 32 of the NITDA Act, which provides the statutory basis for regulatory instruments such as the Nigeria Data Protection Regulation.
- The Freedom of Information Act 2011
The Freedom of Information Act 2011 imposes limits on the disclosure of personal information by public institutions. In particular, Section 14 restricts the disclosure of personal data without the individual’s consent, except as otherwise permitted by law. This provision serves to limit the powers of public authorities, which often hold citizens’ personal data.
Legal Responsibilities of Data Controllers and Processors
Under data protection frameworks, organisations that collect and process personal data are subject to defined legal responsibilities.
A data controller is the entity that determines the purposes for, and the means by which, personal data is processed. It is defined as an individual, private entity, public commission, agency, or any other body that, alone or jointly with others, determines the purposes and means of processing personal data.[12] Examples include banks, hospitals, government agencies, and social media platforms. Data controllers are primarily responsible for ensuring that personal data is processed in accordance with applicable laws.
In many instances, data controllers engage third-party service providers to process data on their behalf. Such entities are referred to as data processors. A data Processor is defined as an individual, private entity, public authority, or any other body that processes personal data on behalf of, or at the direction of, a data controller or another data processor.[13] Examples include cloud storage providers, payment processing companies, and data analytics firms, which may act as processors.
To ensure compliance, many organisations are required to appoint a Data Protection Officer (DPO). The DPO advises the organisation on its legal obligations, monitors compliance with data protection laws, conducts internal audits, and coordinates responses to data breach incidents.[14]
The NDPA imposes several obligations on entities that process personal data, which include:
- Duty of Lawful Processing
Data controllers must ensure that personal data is processed lawfully and transparently. Individuals must be informed of the purposes for which their data is collected and how it will be used.
Section 25(b) outlines the lawful grounds for processing personal data, which are:[15] Performance of a Contract, Legal Obligation, Protection of Interests, Legitimate Interests, Public Interest, or Official Authority.
- Data Subject Rights
Section 34 of the NDPA sets out the rights of data subjects. These include:[16]
- The right to be informed of the purpose of processing.
- The right to know the categories of personal data concerned.
- The right to know the recipients of the personal data, particularly where such recipients are in third countries or international organisations.
- The right to be informed of the period for which the personal data will be stored or, where this is not possible, the criteria used to determine that period.
- The right to request or object to processing, as well as the right to rectification, erasure, or restriction of processing by the data controller.
- The right to lodge a complaint with the Commission and, where personal data is not collected directly from them, the right to be informed of any available information as to its source.
- The right to object to further processing of personal data.
- Data Security Obligations
Organisations are required to implement appropriate technical and organisational measures to safeguard personal data against unauthorised access, accidental loss, or destruction. Such measures include encryption, access controls, and other cybersecurity safeguards.
These obligations are reinforced by the provisions of the Cybercrimes (Prohibition, Prevention, etc.) Act 2015, which criminalises unauthorised access, data interference, and identity theft. In addition, Section 39 of the NDPA emphasises the obligation of data controllers and data processors to implement appropriate technical and organisational measures to ensure the security, integrity, and confidentiality of personal data under their possession or control.[17]
- Data Breach Notification
Where a personal data breach occurs, data controllers are required to notify the NDPC within the time prescribed by the Act, particularly where the breach is likely to pose risks to the rights and freedoms of data subjects.
Section 40 of the NDPA further provides that, where a personal data breach occurs in relation to data processed by a data processor, the data processor must, upon becoming aware of the breach, notify the data controller or the data processor that engaged it. [18] Such notification must describe the nature of the breach, including, where possible, the categories and approximate number of data subjects and personal data records affected.
The data processor is further required to respond to all information requests from the data controller or the data processor that engaged it, as may be necessary to enable compliance with statutory obligations.
Where a breach is likely to affect the rights of a data subject, the data processor must notify the NDPC within 72 hours of becoming aware of the breach. Such notification must, where feasible, describe the nature of the personal data breach, including the categories and approximate number of data subjects and personal data records concerned.
Where the breach is likely to result in serious harm to a data subject, the data subject must be informed in clear and plain language, together with measures that may be taken to mitigate the possible adverse effects of the breach.
- Judicial Enforcement of Data Protection Rights
Nigerian courts increasingly recognise the enforceability of privacy and data protection rights, and judicial decisions reflect a growing willingness to hold institutions accountable for unlawful data processing.
In Digital Rights Lawyers Initiative v National Identity Management Commission[19], the court considered the legality of the government’s national identity database system in relation to privacy and data protection requirements. The decision underscored the obligation of public authorities to conduct data processing in accordance with applicable legal safeguards.
Privacy rights may also be enforced through fundamental rights enforcement proceedings under the Fundamental Rights (Enforcement Procedure) Rules.
Collectively, these legal frameworks impose obligations on organisations to safeguard personal information, prevent unauthorised access, and report relevant cybersecurity incidents. Regulatory agencies are also empowered to oversee compliance, investigate breaches, and enforce sanctions for violations.
Challenges to Data Protection in Nigeria
- Limited Awareness and Education
A significant challenge to the effective implementation of the NDPA is the limited public awareness of data protection and the rights available to individuals whose personal data is processed. Many Nigerians remain unaware of the legal safeguards that protect their personal information and regulate how organisations collect, store, and use it.
Consequently, there is a need for sustained public sensitisation and awareness initiatives targeting both data subjects and data processors. Data subjects should be informed of their rights and the mechanisms available for seeking redress in cases of misuse or unlawful processing of personal data. In contrast, data controllers and processors must be adequately informed of their statutory obligations, compliance requirements, and the legal consequences of non-compliance under the Act. Improved awareness and Education are essential to strengthening accountability, promoting responsible data governance, and ensuring the effective enforcement of Nigeria’s data protection regime.[20]
- Unreported Data Breaches.
Despite legal provisions mandating the reporting of data breaches, many incidents in Nigeria remain unreported or undocumented. This is attributable to several factors. Firstly, enforcement mechanisms are often weak, resulting in limited compliance with statutory reporting obligations. In some instances, organisations lack the requisite technical expertise and personnel to prevent breaches or respond effectively when they occur.
Secondly, regulatory oversight is sometimes inadequate, with enforcement efforts appearing inconsistent. Additional factors include organisational secrecy, lack of trust in regulatory institutions, and fear of reputational damage or industry consequences. These factors collectively contribute to the underreporting of data breaches, notwithstanding the statutory requirement to report certain breaches within 72 hours.[21]
- Poor Record Keeping
Poor record-keeping and data management practices remain a persistent challenge in Nigeria, significantly undermining data protection efforts. Both private and public institutions are affected, often lacking adequate systems for the proper storage, maintenance, and retrieval of data. This deficiency increases organisational vulnerability to cybersecurity breaches and complicates incident response and accountability. In many cases, organisations fail to appoint or adequately empower data protection personnel, such as compliance officers, who possess the expertise required to manage data protection obligations effectively. Furthermore, personal data is frequently collected and processed by entities with which individuals have little or no direct interaction, raising concerns about transparency and accountability. These challenges highlight the need for improved data governance practices in an increasingly digital environment.[22]
Conclusion
The Federal Government of Nigeria must recognise the sensitivity and complexity of data protection and cybersecurity by strengthening existing legal frameworks and ensuring effective enforcement. This includes requiring organisations to engage qualified data protection professionals, promoting continuous Education and training across both public and private sectors, and remaining responsive to evolving technological developments and global best practices.
Keywords: , , data subject, , , constitution, , , data processor, citizens.
- Section 65 of the Nigerian data protection act 2023 (hereinafter referred to as NDPA) ↑
- Cloudian, ‘What is Data Protection and Privacy? (2026) https://cloudian.com/guides/data-protection/data-protection-and-privacy-7-ways-to-protect-user-data/ accessed 11 March, 2026. ↑
- Article 5 of the General Data Protection Regulation (GDPR) ↑
- Alation, ‘Why Is Data Privacy Important? A Guide for Businesses and Individuals’ (2024) https://www.alation.com/blog/why-data-privacy-is-important/ accessed 11 March, 2026. ↑
- Nicholas Patterson, ‘What is Cybersecurity and Why is It Important? (2025) https://www.snhu.edu/about-us/newsroom/stem/what-is-cyber-security accessed 11 March, 2026. ↑
- The Constitution of the Federal Republic of Nigeria, 1999 (as amended), Section 37 ↑
- Section 37 of 1999 Constitution ↑
- [2021] LPELR-55623(CA) ↑
- The Cybercrimes (Prohibition, Prevention) Act 2015, Sections 6 and 9 ↑
- Ibid, Sections 22 to 25 ↑
- Uche Val Obi SAN, “An extensive article on data privacy and data protection law in Nigeria | International Network of Privacy Law Professionals”, 2020 ↑
- Section 65 NDPA ↑
- Section 65 NDPA ↑
- Section 32 NDPA ↑
- The Nigeria Data Protection Act 2023, Section 25(b) ↑
- Ibid, section 34 ↑
- Ibid, Section 39 ↑
- Ibid, Section 40 ↑
- [2021] LPELR-55623(CA) ↑
- SimmonsCooper Partners: The Nigeria Data Protection Bureau And The Challenges Of Data Privacy Compliance In Nigeria. https://www.mondaq.com/nigeria/privacy-protection/1177500/the-nigeria-data-protection-bureau-and-the-challenges-of-data-privacy-compliance-in-nigeria#:~:text=Inadequate%20Sensitization%20on%20Data%20Protection,up%20to%202000%20data%20subjects. Last assessed on 12/05/2026 ↑
- Chidinma Amuta: Challenges of data protection and compliance in Nigeria https://www.linkedin.com/pulse/challenges-data-protection-compliance-nigeria-amuta-mba-llb-bl#:~:text=Nigeria%20faces%20several%20challenges%20with%20data%20protection:,2021%20*%20The%20Freedom%20of%20Information%20Act last assessed on 12/03/2026. ↑
- ibid ↑
