THE EXPANDING FRONTIERS OF DIGITAL PRIVACY RIGHTS IN NIGERIA

CONTRIBUTOR: ANIMASAUN IYANUOLUWA

INTRODUCTION

In today’s digital age, the concept of privacy has transcended traditional boundaries to include the vast scope of personal data stored, processed, and transmitted electronically. The proliferation of big data, artificial intelligence, financial technology (FinTech), and social media platforms has transformed personal information into one of the world’s most valuable assets. Consequently, the protection of digital privacy is now a critical issue, intersecting human rights, national security, and economic policy.

In Nigeria, growing concerns over government surveillance, corporate data breaches, and the unauthorised use of personal data have catalysed significant legal reforms. Chief among them is the enactment of the Nigeria Data Protection Act (NDPA), 2023, which represents a pivotal step toward establishing a robust framework for the protection of digital privacy rights. This article examines the legal and regulatory landscape of digital privacy in Nigeria, highlights the role of cybersecurity, explores emerging challenges, and assesses the role of the judiciary in shaping the enforcement of data protection.

LEGAL FRAMEWORK FOR DIGITAL PRIVACY RIGHTS IN NIGERIA

The principal legislation governing digital privacy in Nigeria is the Nigeria Data Protection Act (NDPA), 2023, which repealed the Nigeria Data Protection Regulation (NDPR), 2019. The NDPA aligns Nigeria’s data protection regime with international standards, particularly the European Union’s General Data Protection Regulation (GDPR). The Act establishes the Nigeria Data Protection Commission (NDPC) as the principal authority responsible for implementation and enforcement.

Important Provisions of the NDPA are:

• Fair Processing: Personal data must be processed fairly, lawfully, clearly, and for a specific purpose.
• Limitation of Purpose and Consent: Data subjects must provide informed consent, and data can only be used for the reasons it was initially mentioned.
• Right of Data Subjects: Data subjects have the right of access, rectification, erasure, limitation, or object to the processing of their personal data.
• Notification of Breaches and Data Security: Organisations should ensure technical and organisational data protection measures and notify of breaches within a reasonable time.
• Cross-Border Transfers: Cross-border transfer of personal data out of Nigeria is not allowed except when the destination country has adequate data protection in place.
• In addition, the privacy right, including homes, correspondence, telephonic communications, and telegraphic messages, of citizens is protected under the Constitution. This constitutional guarantee elevates digital privacy to a fundamental right under Nigerian law.^[1]

THE CONCEPT AND NEED FOR CYBERSECURITY

The term “cybersecurity” describes the methods and tools used to shield data, networks, and computer systems from theft, damage, and illegal access. Cybersecurity and privacy are two sides of the same coin in the digital ecosystem. Cybersecurity makes sure that personal data is safe from breaches, theft, and misuse, while privacy makes sure that it is used and handled legally. ^[2]

Why Cybersecurity Is Essential for Digital Privacy:^[3]

1. Prevention of Data Breaches: Without strong cybersecurity, sensitive personal data is vulnerable to unauthorized access, resulting in identity theft, fraud, and reputational damage.
2. Protection of National Infrastructure: Cybersecurity protects not only individual users but also critical infrastructure such as banking systems, healthcare networks, and government platforms.
3. Trust in Digital Ecosystems: A secure digital environment fosters public trust in online banking, e-commerce, and government services.
4. Regulatory Compliance: Compliance with the NDPA and other relevant laws requires organizations to implement adequate cybersecurity measures.
5. Managing Technological Risks: Emerging technologies like artificial intelligence, cloud computing, and the Internet of Things (IoT) create new vulnerabilities that necessitate proactive cybersecurity strategies.

In Nigeria, the Cybercrimes (Prohibition, Prevention, etc.) Act, 2015 complements the NDPA by criminalizing cyber threats such as identity theft, phishing, cyberstalking, and unauthorized access to computer systems. Section 24 of the Act specifically prohibits offensive or harmful electronic communication, adding a protective layer against data-related offences.

REGULATORY AND ENFORCEMENT MECHANISMS

The primary enforcement agency under the NDPA is the Nigeria Data Protection Commission (NDPC). Among its duties are granting licenses to data controllers and processors, looking into infractions, carrying out compliance audits, and applying administrative sanctions.

The National Information Technology Development Agency (NITDA) is another important regulatory body that was a pioneer in data governance and is still involved in the creation of cybersecurity policies.^[4]

The Central Bank of Nigeria (CBN) oversees digital financial services and enforces Know-Your-Customer (KYC) and data privacy laws.

• Nigerian Communications Commission (NCC): Regulates telecom providers and upholds subscriber data security requirements.

EMERGING CHALLENGE
Despite legislative progress in Nigeria, several challenges continue to prevent the full realization of digital rights to privacy:

1. Large-scale Non-Compliance: The majority of small and medium-sized enterprises lack awareness or the ability to meet NDPA requirements.

   Low Public Awareness: Data subjects are not well aware of their rights or redress avenues, limiting bottom-up enforcement of privacy laws.

2. Poor Cybersecurity Infrastructure: The country is vulnerable to regular cyberattacks due to outdated infrastructure and lack of investment.
3. Absence of Oversight of Government Spying: Security agencies usually function under general “national security” exemptions without the judiciary’s oversight, posing a conflict between state interests and individual rights.
4. Challenges in Cross-Border Data Transfer: Nigeria’s digital economy experiences hiccups in global transactions because of data localization demands and insufficient global cooperation mechanisms.

THE JUDICIARY’S FUNCTION

Nigerian courts are increasingly called upon to interpret and enforce the right to digital privacy. Judicial activism also plays a vital role in ensuring that public institutions and private entities comply with their constitutional and legal obligations regarding data protection.^[5]

RECOMMENDATIONS

To ensure the full enforcement and protection of digital privacy rights in Nigeria, the following measures are recommended:

• Public Education and Advocacy: Increase public awareness through campaigns, workshops, and digital literacy programs focused on data rights and cyber hygiene.
• Capacity Building for Regulators: Strengthen the technical, human, and financial resources of the NDPC and related agencies to enhance enforcement.
• Harmonization with Global Standards: Align Nigeria’s framework more closely with international protocols such as the GDPR to facilitate cross-border data exchange.
• Oversight of Surveillance Practices: Enact legislation requiring court warrants and periodic audits for any state surveillance involving personal data.^[6]
• Mandatory Cybersecurity Compliance: All data processors and controllers should be required to implement minimum cybersecurity standards as a condition for licensing.

CONCLUSION

Digital privacy rights in Nigeria are on a promising but delicate trajectory. The passage of the NDPA 2023 represents a major advancement, yet its success depends on coordinated regulatory action, judicial enforcement, public awareness, and strong cybersecurity systems. As Nigeria embraces a data-driven economy, safeguarding the rights of individuals must remain a top priority to ensure that innovation is not achieved at the expense of fundamental freedoms.

REFERENCE

1. Section 37 of the 1999 Constitution of the Federal Republic of Nigeria (as amended) ↑
2. Nwankwo, O. (2023). Cybersecurity and the Right to Privacy in Nigeria: Legal Framework and Emerging Challenges. Accessed on 25^th July 2025 ↑
3. National Cybersecurity Policy and Strategy (NCPS), 2021 Office of the National Security Adviser (ONSA) Retrieved from: https://www.onsa.gov.ng accessed on 25^th July 2025 ↑
4. Nigeria Data Protection Regulation (NDPR), 2019 Retrieved from: https://nitda.gov.ng accessed on 25^th July 2025 ↑
5. Socio-Economic Rights and Accountability Project (SERAP) v. Federal Republic of Nigeria
   ECW/CCJ/APP/08/19, ECOWAS Community Court of Justice, 2020; Okedara v. Attorney-General of the Federation (2020) LPELR-50936(CA) ↑
6. United Nations General Assembly. (1948). Universal Declaration of Human Rights Article 12 (Right to Privacy) ↑