On June 12, 2023, President Bola Ahmed Tinubu signed the Nigeria Data Protection Act, 2023 into law. This marked a significant watershed in the country’s journey towards developing a primary legislative framework for the protection of personal information of natural persons residing or doing business in Nigeria.
The Act provides, among others, for governing framework for processing personal data; rights of a data subject; data security; cross-border transfer of personal data; requirements for data controllers and data processors of major importance; compliance, infringements, penalties, and dispute resolution; and the establishment of the Nigeria Data Protection Commission, as an independent body to superintend and regulate data protection matters, and enforce compliance with the provisions of the Act.
Prior to the enactment of the Act, there have been attempts at ensuring the protection of personal data in Nigeria by the relevant government agencies through subsidiary legislation, such as the Nigeria Data Protection Regulation 2019, issued by the National Information Technology Development Agency, a government and regulatory agency under the supervision of the Federal Ministry of Communications and Digital Economy (FMCDE). While the Data Protection Regulation may have filled the gap for some time in Nigeria, being a secondary source of law with a weaker legal and judicial weight, it does not provide enough comfort to foreign investors and partners who are becoming increasingly averse to data porous operating environments and markets.
In today’s digital world, where large volumes of data are being generated, stored, and processed online, privacy and data protection have become a top priority for many countries, businesses, and individuals alike. The imperative of safeguarding citizens’ privacy and data rights led to a joint effort between the Nigeria Data Protection Bureau (another regulatory agency recently established under the supervision of the FMCDE and now to be transformed into the Nigeria Data Protection Commission) and the International Development Association (a member of the World Bank Group), through the Nigeria Digital Identification for Development Project (NID4D), which eventually culminated in sponsoring the Bill that gave birth to the Nigeria Data Protection Act.
The Act is a welcome development, coming at a time Nigeria is taking great strides towards the full realization of a digital economy. Notably, the digital economy is data-based and data-driven. Any nation that aims to onboard a digital economy must not only invest in digital technologies but also have in place a reliable national database, that is supported by strong and effective data protection legislation. It is expected that the Act will boost the confidence of all Nigerian citizens and residents to fully support the country’s digital economy ambition.
The full implementation of the Act will improve the business environment in Nigeria and increase investor confidence, as companies will have a clear set of guidelines to follow when collecting and processing personal data. The Act will also enhance Nigeria’s reputation as a safe and secure place to do business, attracting more foreign investment and boosting economic growth.
Banwo & Ighodalo, acting as legal advisers to the NID4D with the support of the World Bank, played a pivotal role in the emergence of the Nigeria Data Protection Act through the provision of advisory, consultative and advocacy services to key actors on the executive and legislative sides. Specifically, the law firm facilitated consultative and advisory sessions with members of Nigeria’s bicameral National Assembly (House of Representatives and The Senate) towards the passage of the Executive Bill and facilitated presidential assent to the passed Bill through high-level engagements with the Executive and the Presidency.
