X-Raying the Code of Conduct for Data Compliance Organisations in Nigeria

CONTRIBUTOR: TOBENNA MOGBO

INTRODUCTION

In today’s context, where data is commonly termed the “new oil,”^[1] the ethical management and safeguarding of this resource have emerged as critical considerations for governments, businesses, and regulatory agencies globally.^[2] The swift advancements in digital technologies have significantly amplified data-driven practices, showing the need for robust data protection frameworks that ensure the privacy rights of individuals are maintained. In Nigeria, the introduction of the Nigeria Data Protection Act (NDPA) 2023 aims to regulate data processing activities and facilitate compliance with established privacy standards and a notable aspect of this regulatory landscape is the establishment of Data Protection Compliance Organizations which are licensed entities designated to monitor, audit, and ensure adherence to legal and ethical standards by data controllers and processors.^[3]

To enhance the functioning of DPCOs and promote professionalism within the data compliance sector, the Nigeria Data Protection Commission (the Commission) formulated a Code of Conduct intended to guide these organizations.^[4] This Code delineates essential principles, operational protocols, and ethical standards that DPCOs must follow while fulfilling their compliance responsibilities.^[5] It addresses various elements of data protection, such as obligations to data subjects, duties to regulatory authorities, and responsibilities toward clients (including data controllers and processors). Furthermore, the Code stipulates disciplinary measures and enforcement mechanisms aimed at ensuring that compliance organizations operate with integrity, transparency, and accountability.^[6]

Given the nascent nature of DPCOs within Nigeria’s data governance paradigm, a thorough assessment of the Code of Conduct is essential to evaluate its effectiveness in fostering compliance, safeguarding the interests of data subjects, and bolstering trust within Nigeria’s digital economy. Although the Code articulates clear responsibilities and enforcement strategies, its practical effectiveness hinges on the implementation and enforcement of these guidelines.

Key Objectives and Principles of the Code

The Code of Conduct for Data Protection Compliance Organizations (DPCOs) serves as an essential framework aimed at ensuring professionalism and accountability within Nigeria’s data protection landscape.^[7] Established under the NDPA 2023,^[8] DPCOs are instrumental in facilitating adherence to data protection regulations through their roles in monitoring, auditing, and providing counsel to data controllers and processors. To uphold the integrity of these compliance organizations, the Code stipulates rigorous registration protocols and competency standards. According to Article 3, registration as a DPCO is restricted to law firms, ICT service providers, and management consultancy organizations that employ certified Data Protection Officers.^[9] This stipulation guarantees that compliance activities are managed by qualified professionals possessing expertise in areas such as cybersecurity, data science, information security, and data privacy law, etc.^[10] By setting these elevated criteria, the Code fortifies professional integrity and fosters public trust, thereby deterring unqualified or unethical entities from engaging in compliance services.

Moreover, the Code cultivates accountability through the establishment of explicit responsibilities for DPCOs. Article 6 mandates that these organizations maintain transparent interactions with the Commission, ensuring truthful disclosures in compliance audits, data privacy impact assessments, and regulatory filings. They are also required to actively participate in Commission-directed meetings and carry out campaigns aimed at raising public awareness about data privacy. In addition, Article 8 accentuates personal accountability by necessitating ongoing personnel training, promoting ethical practices in the workplace, and safeguarding the confidentiality of sensitive information. This dedication to high professional standards and continuous capacity development is crucial for mitigating malpractices and preventing regulatory infractions, thereby enhancing Nigeria’s overall data governance framework.

To achieve consistency in compliance processes, the Code introduces a standardized approach to regulatory services. As per Article 4, DPCOs are obliged to adhere to a structured methodology when delivering compliance services, which encompasses the registration of data controllers and processors, conducting compliance audits, and implementing data privacy frameworks. Furthermore, these organizations are tasked with creating pivotal internal compliance documents, such as consent forms, data breach notification templates, and data privacy agreements. The Code also establishes regulatory platforms to facilitate DPCOs in efficiently filing audit reports, submitting risk mitigation strategies, and processing data breach notifications.^[11] By ensuring that all compliance-related activities conform to a uniform structure, the Code effectively reduces inconsistencies and legal gaps, thereby streamlining the landscape of data protection in Nigeria.

Ethical practices in data protection constitute a fundamental aspect of the Code. Article 2 requires DPCOs to incorporate privacy-oriented principles into their compliance services, thereby ensuring that the essential rights of data subjects are consistently prioritized and this is especially crucial in scenarios where data controllers or processors exercise discretion in data processing decisions. To mitigate potential ethical breaches, DPCOs are expected to actively promote data ethics, fairness, and integrity throughout their compliance processes. Furthermore, Article 5 highlights the obligation to care for data subjects, compelling DPCOs to protect individual rights, address complaints in a timely manner, and facilitate transparent communication between data controllers and data subjects. The scope of ethical responsibilities also encompasses interactions with other compliance organizations, as Article 9 explicitly prohibits unfair competition, client poaching, and any form of unethical business conduct. These ethical provisions serve to bolster the credibility of the compliance industry, ensuring that DPCOs uphold the highest standards of integrity and accountability.

Going further, the Code seeks to cultivate trust and discipline within the compliance sector by implementing stringent regulatory oversight and enforcement mechanisms. The degree of public confidence in data protection legislation is closely linked to the transparency and dependability of compliance organizations. To attain this goal, the Code stipulates the necessity of regular audit reports, transparent interactions with the Commission, and comprehensive disclosure of pertinent compliance documents.^[12] In addition, Article 7 mandates that DPCOs meet their responsibilities to clients, namely, data controllers and processors, by conducting thorough compliance evaluations, providing clear regulatory reports, and advocating for privacy-by-design principles. This framework strengthens the dynamic between businesses and compliance organizations, ensuring that the enforcement of data protection regulations is both effective and uniform.

To further instill discipline, Article 10 delineates the circumstances under which a DPCO may have its license revoked. The Commission possesses the authority to rescind a DPCO’s license if it is found in violation of data protection laws, engaged in fraudulent conduct, or failed to meet regulatory responsibilities.^[13] Also, DPCOs that neglect to pay renewal fees for their licenses may face accreditation loss.^[14] These disciplinary actions serve as a deterrent against misconduct, ensuring that only trustworthy and ethical compliance firms operate within Nigeria’s data governance framework. Consequently, the Code of Conduct not only fosters trust in the regulatory process but also enhances public confidence in Nigeria’s digital economy.

CONCLUSION

In summary, the Code of Conduct for Data Protection Compliance Officers (DPCOs) serves as a vital regulatory framework that promotes professionalism, accountability, and consistency in adhering to data compliance standards. By outlining rigorous operational criteria, enforcing ethical responsibilities, and establishing mechanisms for discipline, it plays a key role in ensuring the effective and transparent adherence to data protection regulations. Collectively, these elements foster an atmosphere of trust, discipline, and compliance within Nigeria’s dynamic data protection environment, thereby positioning the nation as a frontrunner in responsible data governance on the global stage.

REFERENCE

1. See Hirsch, Dennis D. “The glass house effect: Big Data, the new oil, and the power of analogy.” Me. L. Rev. 66 (2013): 373. ↑
2. Renuka, Oladri, et al. “Data Privacy and Protection: Legal and Ethical Challenges.” Emerging Threats and Countermeasures in Cybersecurity (2025): 433-465. ↑
3. Section 33 NDPA 2023 ↑
4. Ibid. ↑
5. Code Of Conduct for Data Protection Compliance Organizations (DPCOS) 2023 available at https://ndpc.gov.ng/resources/ accessed February, 2025. ↑
6. Ibid. ↑
7. See Article 1 of the Code ↑
8. Section 33 (b) of the Act. ↑
9. Article 3(4) & (5) of the Code. ↑
10. Ibid. ↑
11. Article 3(2) ↑
12. Article 6. ↑
13. Article 10 ↑
14. Art. 10(2) ↑