The National Data Protection Commission (NDPC) has underscored the importance of strict compliance with data protection and privacy principles as Nigeria steps up efforts to safeguard personal information in the digital age.
The News Agency of Nigeria (NAN) reports that the commission made this known on Tuesday, during a training for journalists in Lagos.
The event with the theme “Privacy in the Age of Emerging Technologies: Trust, Ethics and Innovation”, was organised as part of activities to mark the 2026 National Privacy Week.
In his presentation, a facilitator at the training, Mr Alex Onwe, said that data protection focuses on measures put in place to safeguard data against unauthorised access, breaches or loss.
On the other hand, he said that data privacy empowers individuals to determine who can process their data and for what purpose.
Onwe said that section 37 of the 1999 Constitution (as amended) guarantees protection of the privacy of citizens, their homes, correspondence and communications.
He outlined key data protection concepts, including data processing, personal data, data subjects, data controllers and data processors, noting that personal data includes information such as names, identification numbers, contact details and online identifiers.
According to him, sensitive personal data including: health records, genetic information, religious beliefs and criminal records, require higher levels of protection and could only be processed under conditions permitted by law.
The legal practitioner said that the Nigeria Data Protection Act (NDP Act), 2023, provides the legal framework for the protection of personal data in the country.
“The Act establishes the NDPC as an independent regulatory body and sets out clear obligations for data controllers and processors, including data security, cross-border data transfers, compliance requirements and penalties for violations,” he said.
Onwe explained that the Act applies to organisations operating in Nigeria or processing the data of Nigerians, even if they were domiciled outside the country, adding that certain exemptions were allowed under limited circumstances.
He highlighted core principles guiding personal data processing under the Act, including lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability.
Onwe also stressed the rights of data subjects under the Act, such as the right to be informed, access personal data, rectify inaccuracies, object to processing and request erasure, adding that data controllers are responsible for ensuring these rights are respected.
On child data protection, he said that parental consent and effective age-verification mechanisms were mandatory when processing the personal data of minors.
He further explained that organisations are required to implement appropriate technical and organisational measures, to ensure data security, including encryption, access control, cybersecurity systems, staff training and breach notification procedures.
Onwe warned that failure to comply with the Act, attracts penalties ranging from two million naira, to N10 million, or up to two per cent of an organisation’s annual gross revenue, depending on its classification.
Speaking on the objectives of the week, the National Commissioner, NDPC, Dr Vincent Olatunji, said it aims to raise awareness about data privacy risks, promote responsible data handling and educate citizens on safeguarding personal information.
Olatunji said the commission had recorded significant achievements, including the registration of over 38,000 data controllers and processors, as well as the conclusion of 246 data breach investigations and enforcement actions against defaulting organisations.
He added that the data protection ecosystem had created over 23,000 jobs nationwide.
According to him, plans for 2026 include intensified enforcement of the Nigeria Data Protection Act, increased public awareness, capacity building and certification of data protection professionals to global standards.
themomentng reports that the National Privacy Week which began on Jan. 28, will end on Feb. 4.
