Every time a Nigerian opens a bank account, registers for a fintech app, submits a CV, visits a hospital, enrols in a school, shops online or creates an account on a digital platform, they hand over personal information to an organisation. That information can include a name, phone number, email address, identification details, financial information, health records, location data and other details that can be linked to an individual.
The Nigeria Data Protection Commission, commonly known as the NDPC, exists to regulate how organisations handle that information and to protect the privacy rights of people whose data they collect and process.
The Commission was established under the Nigeria Data Protection Act 2023, which became law on June 12, 2023. The Act gives the NDPC responsibility for overseeing Nigeria’s data protection framework and supervising organisations that process personal data. According to the Commission, its mandate includes safeguarding the rights of natural persons to data privacy, promoting secure data processing practices and strengthening the legal foundations of Nigeria’s digital economy.
This makes the NDPC relevant far beyond technology companies. Banks, fintechs, telecommunications companies, employers, schools, hospitals, government agencies, online businesses and other organisations that collect or process personal data can fall within the scope of Nigeria’s data protection framework.
What is the NDPC?
The Nigeria Data Protection Commission is Nigeria’s independent regulatory authority for data protection and privacy.
Before the NDP Act 2023 established the Commission, Nigeria’s data protection regime operated mainly under the Nigeria Data Protection Regulation 2019 and the former National Information Technology Development Agency framework. The 2023 Act created a dedicated commission with a broader statutory mandate.
The Commission describes its role as protecting privacy rights, enforcing data protection regulations and promoting responsible handling of personal data in Nigeria. Its responsibilities include supervising data controllers and processors, handling privacy breach reports, registering relevant organisations and licensing Data Protection Compliance Organisations, known as DPCOs.
In practical terms, the NDPC provides the regulatory framework that organisations must consider when they decide what personal information to collect, why they need it, how they use it, how long they keep it and what safeguards they put in place.
That makes data protection more than a technical issue for cybersecurity teams. It is also a business, consumer rights and governance issue.
Why Nigeria needs a data protection regulator
Personal data has become an important part of how Nigeria’s digital economy works.
A bank needs customer information to open and manage accounts. A fintech may need identity, transaction and device information to provide financial services and detect fraud. A telecommunications company handles information about millions of subscribers. An employer collects employee records, payroll information and sometimes sensitive personal information. Hospitals and health platforms deal with information that can be particularly private.
The more services move online, the more organisations depend on personal data to operate.
That creates a need for rules that establish what organisations can do with people’s information and what protections individuals have when those rules are broken. The Nigeria Data Protection Act states objectives that include regulating the processing of personal data, protecting data subjects’ rights, ensuring fair and accountable processing and providing remedies when rights are breached.
The NDPC therefore sits at an important point between Nigeria’s growing use of data and the rights of the people behind that data.
What does the NDPC actually do?
The NDPC has several responsibilities under the Nigeria Data Protection Act 2023, but its work can be understood through a few practical areas.
1. It regulates how organisations process personal data
The NDPC supervises data controllers and data processors.
A data controller is generally an organisation or person that determines why and how personal data will be processed. A data processor processes personal data on behalf of a controller.
For example, a bank deciding what customer information it needs and why it needs that information can be a data controller. A technology company processing that information on the bank’s behalf can act as a data processor, depending on the arrangement.
The distinction matters because organisations cannot simply collect personal information and use it however they choose. The NDP Act establishes requirements around lawful, fair and accountable processing, while also giving data subjects rights over their information.
2. It protects data privacy rights
One of the most important parts of the NDPC’s work is giving individuals a regulatory framework through which they can exercise their rights over personal data.
The Commission currently lists several rights available to data subjects, including the right to be informed, the right to access personal data, the right to rectification, the right to object to processing, the right to restrict processing and the right to data portability. It also lists the right to erasure, often described as the right to be forgotten, and protections relating to automated decision-making.
These rights give people more control over information organisations hold about them.
For example, if a company holds inaccurate personal information about a customer, the right to rectification provides a basis for asking that the information be corrected. If someone wants to understand how an organisation is using their personal information, data protection rights can provide a route for obtaining relevant information.
This is why data protection is not only about companies completing compliance requirements. It also concerns the relationship between organisations and the people whose information they use.
3. It registers and supervises relevant organisations
The NDPC operates registration processes for data controllers and processors and maintains information on Data Controllers and Data Processors of Major Importance.
The Commission’s registration guidance explains that the Nigeria Data Protection Act gives it powers to designate organisations as data controllers or processors of major importance. These include organisations whose processing activities meet specified conditions relating to the volume or nature of personal data involved and organisations whose activities have particular significance to Nigeria’s economy, society or security.
The registration requirement means data protection becomes part of organisational governance rather than something a company only considers after a breach.
Businesses that handle large amounts of customer or employee information therefore need to understand their obligations before collecting and processing that information.
4. It investigates privacy breaches and complaints
Data breaches are another important part of the NDPC’s regulatory role.
When personal information is exposed, stolen, accessed without authorisation or otherwise compromised, the consequences can extend beyond a cybersecurity incident. A breach can expose people to identity theft, financial fraud, impersonation, harassment and other forms of harm.
The NDPC provides a privacy breach reporting channel and has powers under the data protection framework to investigate issues involving violations of data protection requirements.
This is particularly important in Nigeria’s financial and technology sectors, where organisations process large volumes of customer information. A breach involving a bank, fintech or digital platform can therefore become both a cybersecurity issue and a data protection issue.
5. It enforces compliance with Nigeria’s data protection law
The NDPC is not simply an organisation that publishes guidelines and educational materials. It has regulatory and enforcement responsibilities under the Nigeria Data Protection Act.
The Act provides for sanctions and remedies where data protection requirements are breached. The Commission’s FAQ also states that non-compliance can result in administrative or criminal sanctions and civil actions, depending on the circumstances.
This gives organisations a reason to treat data protection as an ongoing responsibility rather than a document that sits with a compliance team.
For businesses, compliance therefore involves understanding the information they collect, identifying why they collect it, controlling access to it, protecting it and ensuring that their data-processing practices meet applicable requirements.
What rights do Nigerians have over their personal data?
The NDP Act gives data subjects several rights that are important for anyone who interacts with organisations that collect personal information.
Among the rights highlighted by the NDPC are:
- The right to be informed about the processing of personal data
- The right to access personal data
- The right to request correction of inaccurate information
- The right to object to certain processing
- The right to restrict processing in applicable circumstances
- The right to data portability
- The right to erasure or to be forgotten in applicable circumstances
- The right to report concerns to the supervisory authority
- Rights relating to automated decision-making
These rights matter because people often give organisations information without knowing exactly how that information will be used later.
A customer may provide their phone number to a bank. An employee may submit personal documents to an employer. A student may provide information to a university. A patient may provide health information to a hospital. In each case, the organisation has responsibilities around how that information is processed.
The existence of these rights does not mean every request must automatically be granted in every circumstance. Data protection law also recognises lawful grounds for processing and situations where other legal obligations apply. The important point is that organisations must have a lawful basis for processing personal data and must follow the requirements of the applicable data protection framework.
What does the NDPC mean for banks and fintechs?
The financial sector is one of the clearest examples of why data protection matters.
Banks and fintech companies handle information that can reveal a customer’s identity, financial behaviour, transactions and other personal details. They also operate in an environment where fraud prevention, customer verification and regulatory reporting require significant data processing.
Data protection does not prevent financial institutions from collecting information they legitimately need to provide regulated services. Instead, it places requirements around how that information is collected, processed, secured and used.
For customers, this means data privacy should be part of the conversation around digital banking just as much as convenience, security and service reliability.
For financial institutions, data protection should sit alongside cybersecurity, risk management and regulatory compliance.
Techsoma’s earlier coverage of alleged data breach claims involving Nigerian financial platforms provides another example of why the distinction matters. A cybersecurity incident can raise questions about whether personal data was exposed and whether an organisation met its obligations to protect that information. Nigeria’s data breach claims exposed a critical cybersecurity coordination gap explores that wider coordination problem.
What does the NDPC mean for employers?
Data protection also applies to the workplace.
Employers collect information during recruitment and continue processing employee information after someone joins an organisation. This can include names, contact information, identification documents, bank details, performance records, attendance information and other employment-related data.
Human resources teams therefore have a direct role in data protection.
An organisation cannot treat employee information as ordinary administrative material simply because it collected the information for employment purposes. It still needs to consider why the information is being collected, who can access it, how it is stored and when it should no longer be retained.
This becomes even more important as employers adopt cloud HR systems, employee monitoring tools, AI recruitment platforms and other technologies that can process large amounts of employee and applicant information.
What does the NDPC mean for schools and hospitals?
Schools and healthcare providers also process personal information on a regular basis.
A school may hold information about students, parents, guardians, staff and emergency contacts. A hospital can process medical records and other information that requires a high level of privacy and security.
The Nigeria Data Protection Act’s framework therefore reaches well beyond the technology sector.
For organisations in these sectors, data protection involves understanding what information is necessary, limiting access to authorised people, protecting records from unauthorised access and ensuring that information is not used for purposes that conflict with applicable requirements.
The NDPC’s role is particularly relevant as schools, hospitals and other service providers increasingly move records and services onto digital platforms.
What are DPCOs and why do they matter?
Another part of Nigeria’s data protection system is the Data Protection Compliance Organisation, or DPCO.
DPCOs are licensed organisations that support entities with data protection compliance activities. The NDPC maintains a list of licensed DPCOs as part of its regulatory framework.
For a business that is trying to understand its obligations under the Nigeria Data Protection Act, a DPCO can provide professional support around compliance.
This does not remove the organisation’s responsibility for its own data protection practices. Instead, it gives businesses access to specialist support as they assess their processing activities and work towards compliance.
The distinction is important because data protection should not become a box-ticking exercise outsourced entirely to a consultant. The organisation that collects and uses personal information remains responsible for understanding how its own systems and processes work.
Does the NDPC regulate every technology company directly?
The NDPC is the national regulator for data protection and privacy, but it does not operate in isolation from Nigeria’s wider regulatory system.
Different regulators have responsibilities within specific sectors. The NDPC’s own explanation of its mandate notes that it complements the work of other statutory institutions that also have roles in safeguarding privacy and protecting consumers.
For a fintech, for example, data protection requirements can exist alongside financial regulations. A telecommunications company can have obligations under both data protection and communications regulation. A digital platform can also have responsibilities under other laws depending on the service it provides.
This means businesses should not treat NDPC compliance as a substitute for other regulatory obligations.
The better approach is to see data protection as one part of the broader regulatory environment in which a digital business operates.
Why the NDPC matters to Nigeria’s digital economy
Nigeria’s digital economy depends heavily on trust.
People will continue to use digital banking, fintech applications, online commerce, health platforms, education technology and other digital services only if they have reasonable confidence that their information will not be carelessly handled.
The NDPC’s mandate therefore has an economic dimension as well as a privacy dimension.
The Commission itself identifies strengthening the legal foundations of Nigeria’s digital economy and enabling trusted use of personal data as part of the objectives of the Nigeria Data Protection Act.
This becomes more important as Nigerian businesses build products that depend on large amounts of personal information and as organisations adopt artificial intelligence and other data-intensive technologies.
A weak approach to data protection can increase the risks associated with breaches, misuse and loss of trust. A stronger regulatory environment gives organisations clearer responsibilities while giving individuals a framework for protecting their rights.
The NDPC is becoming part of everyday digital life
Data protection can sound like a subject reserved for lawyers, compliance officers and cybersecurity professionals. In reality, it is becoming part of ordinary digital life in Nigeria.
Anyone who has opened a bank account, registered for a mobile service, applied for a job, joined an online platform or submitted personal information to a business has interacted with the data economy.
The NDPC’s current work reflects that broader reach. Its official resources now include the Nigeria Data Protection Act in Yoruba, Hausa and Igbo, alongside privacy education initiatives and other materials designed to make data protection more accessible.
That wider public understanding matters because regulation works better when people know both their rights and the responsibilities of the organisations handling their information.
For businesses, the implication is equally straightforward. Data protection cannot be treated as an issue to address only after a complaint or breach. It needs to be considered when products are designed, customer information is collected, systems are built and business processes are created.
What Nigerians should remember about the NDPC
The most important thing to understand about the NDPC is that its work affects the relationship between people, organisations and personal data.
For individuals, the Commission provides a regulatory framework for privacy rights and a channel through which data protection concerns can be raised.
For businesses, the NDPC provides oversight and enforcement within Nigeria’s data protection framework and expects organisations that process personal data to meet their legal obligations.
For Nigeria’s digital economy, the Commission has a wider role in building trust around the use of personal data.
The practical lesson is that data protection is no longer a narrow technology issue. It touches financial services, telecommunications, employment, education, healthcare, e-commerce and almost every other part of an increasingly digital economy.
As more Nigerian services depend on personal information, understanding what the NDPC does will become increasingly important for both the organisations processing that information and the people providing it.
Explore the Commission’s official resources.
