The Nigeria Data Protection Commission (NDPC) has said it would start imposing heavy fines against businesses that are handling Nigerians’ data otherwise referred to as data controllers and data processors, starting this year.
The National Commissioner of the Commission, Dr. Vincent Olatunji, disclosed this in his outlook for the year.
According to him, NDPC up until now has not fined any company but that will start this year as it begins massive enforcement of the Nigeria Data Protection Act (NDPA).
“For data controllers and processors, there is going to be massive enforcement in 2025. We have never issued any fines, but going forward you will hear us issuing heavy penalties,” Olatunji stated.
Data protection jobs
While noting that the Commission would begin the second phase of its 2023-2027 Roadmap this year, Olatunji said the NDPC would also be creating jobs through data protection experts it trained last year.
- According to him, Nigerians will in 2025 start seeing the result of the experts, professionals, and a pool of globally competing human capital that the NDPC has been trying to develop in the data protection ecosystem, which would lead to job creation.
- He added that the Commission would also continue data protection awareness across the country to ensure that Nigerians are aware of their rights.
“There are a lot of data controllers and processors that are looking for people to work with them.
“Now those that we have trained in 2024, those we have certified, we are going to do more this year to actually launch them to the job market where they can really work with data controllers and processors,” the Commissioner said.
Registration and audit return
Ahead of this year’s enforcement plan, the NDPC Commissioner at a forum in Lagos in 2023 announced the timeline for the registration of all data controllers and processors, which include all organizations that deal with people’s data such as banks, telecom operators, insurance companies, schools, among others.
“What we have in the law is that all data controllers and processors and there are over 500,000 in Nigeria, that they should register with the data protection authority.
“What the law says is that we should give them six months to acquaint themselves with the provisions of the law.
“And that is why carrying out awareness across the country, we are going to do another one in Abuja very soon. The data controllers need to register with us because you can’t count them if you don’t know them. So, we need to have a number, and then those that are captured will be monitored to see how they are managing the data in their care and we can regulate them appropriately.
“So, between now and December 31, they are to register with the commission. And from the first of January to 31st of March next year (2024), they are to submit their annual audit report, telling us what they have done in the area of putting in place measures to safeguard our data with them.”
What you should know
President Bola Tinubu signed the country’s Data Protection Bill into law on June 12, 2023.
- That transformed the existing National Data Protection Bureau headed by Olatunji into a Commission saddled with the responsibilities of driving the implementation of the law.
- Globally, the enforcement of data protection became a major issue last year with several data protection watchdogs, especially in the EU countries imposing heavy fines on multinationals for breaching data protection laws.
- Social media platforms such as Meta, LinkedIn, and TikTok, among others were at the receiving end of data protection sanctions in 2024.