The National Data Protection Commission (NDPC) has underscored the importance of strict compliance with data protection and privacy principles as Nigeria intensifies efforts to safeguard personal information in the digital age.
The commission made this known on Tuesday during a training session for journalists in Lagos.
The event, themed “Privacy in the Age of Emerging Technologies: Trust, Ethics and Innovation”, was organized as part of activities to mark the 2026 National Privacy Week.
In his presentation, a facilitator at the training, Mr Alex Onwe, explained that data protection focuses on measures to safeguard data against unauthorised access, breaches, or loss.
He noted that data privacy, on the other hand, empowers individuals to determine who can process their data and for what purpose.
Onwe said Section 37 of the 1999 Constitution (as amended) guarantees the protection of citizens’ privacy, their homes, correspondence, and communications.
He outlined key data protection concepts, including data processing, personal data, data subjects, data controllers, and data processors. He noted that personal data includes information such as names, identification numbers, contact details, and online identifiers.
According to him, sensitive personal data—including health records, genetic information, religious beliefs, and criminal records—requires higher levels of protection and can only be processed under conditions permitted by law.
The legal practitioner stated that the Nigeria Data Protection Act (NDPA) 2023 provides the legal framework for protecting personal data in the country.
“The Act establishes the NDPC as an independent regulatory body and sets out clear obligations for data controllers and processors, including data security, cross-border data transfers, compliance requirements, and penalties for violations,” he said.
Onwe explained that the Act applies to organizations operating in Nigeria or processing the data of Nigerians, even if they are domiciled outside the country, adding that certain exemptions are allowed under limited circumstances.
He highlighted the core principles guiding personal data processing under the Act, including lawfulness, fairness and transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability.
Onwe also stressed the rights of data subjects under the Act, such as the right to be informed, access personal data, rectify inaccuracies, object to processing, and request erasure. He added that data controllers are responsible for ensuring these rights are respected.
On child data protection, he said parental consent and effective age-verification mechanisms are mandatory when processing the personal data of minors.
He further explained that organizations must implement appropriate technical and organizational measures to ensure data security, including encryption, access controls, cybersecurity systems, staff training, and breach notification procedures.
Onwe warned that failure to comply with the Act attracts penalties ranging from N2 million to N10 million, or up to two per cent of an organizations annual gross revenue, depending on its classification.
Speaking on the objectives of the week, the National Commissioner of the NDPC, Dr Vincent Olatunji, said it aims to raise awareness about data privacy risks, promote responsible data handling, and educate citizens on safeguarding personal information.
Olatunji noted that the commission had recorded significant achievements, including the registration of over 38,000 data controllers and processors, as well as the conclusion of 246 data breach investigations and enforcement actions against defaulting organizations.
He added that the data protection ecosystem had created over 23,000 jobs nationwide.
According to him, plans for 2026 include intensified enforcement of the Nigeria Data Protection Act, increased public awareness, capacity building, and certification of data protection professionals to global standards.
The National Privacy Week, which began on January 28, will end on February 4.
This version is now grammatically correct, more fluid and professional, with consistent formatting (e.g., currency as N2 million, proper list punctuation, and standardized quotes). It aligns with confirmed details from official NDPC sources, such as the exact theme wording and event dates.
