The Nigeria Data Protection Commission has investigated more than 240 cases of data breaches and identified over 1,900 organisations for non-compliance with the country’s data protection regulations.
The National Commissioner and Chief Executive Officer of the commission, Dr Vincent Olatunji, disclosed this on Thursday at the opening of a two-day capacity-building workshop for judicial officers on data protection, organised in collaboration with the National Judicial Institute in Abuja.
Olatunji said the commission had also issued more than 20 major remediation orders as part of efforts to strengthen accountability and protect Nigerians’ personal information.
Highlighting the commission’s enforcement activities, he said, “Investigated over 240 cases of data breach,” adding that it had “issued over 20 major remediation orders” and “issued Public Notices identifying over 1,900 non-compliant organisations to drive remediation.”
The disclosures indicate increasing regulatory scrutiny of organisations handling personal information, although the commission did not specify the organisations involved, the nature of the breaches or the penalties imposed.
Olatunji further disclosed that the NDPC had registered more than 41,000 data controllers and processors of major importance within three years and received over 8,000 compliance audit returns.
He said 367 Data Protection Compliance Organisations had been licensed to support compliance nationwide, while the commission had issued the General Application and Implementation Directive under the Nigeria Data Protection Act 2023.
According to him, the legislation has also been translated into Yoruba, Igbo and Hausa to improve public understanding of data protection obligations.
The commissioner explained that Nigeria’s expanding digital economy had made stronger safeguards necessary, particularly as electronic transactions, virtual court hearings and digital communication increasingly exposed citizens to risks associated with personal data processing.
“In effect, wherever an individual’s data is, he should be able to exercise control over it, subject only to the reasonable limitation imposed by a law in a democratic society,” he stated.
He identified Section 37 of the 1999 Constitution as a foundation for privacy protection, explaining that the Data Protection Act established additional mechanisms for safeguarding personal information.
Olatunji stressed the judiciary’s responsibility in resolving disputes arising from regulatory decisions, noting that Section 50 of the Act permits dissatisfied parties to seek judicial review.
“A person who is not satisfied with an order of the Commission may apply to the court for judicial review within 30 days after the order was made,” he quoted the legislation as providing.
He also urged greater alignment with international data protection standards, including the European Union’s General Data Protection Regulation and relevant African and ECOWAS frameworks.
On the commission’s economic impact, Olatunji disclosed that Nigeria’s data protection ecosystem had generated more than 27,000 jobs, while over 1,500 data protection officers had been certified through a national programme.
He added that another 5,000 individuals had obtained certifications through private initiatives, while the commission’s Virtual Privacy Academy had benefited more than 66,000 people.
Other achievements included 19 university privacy clubs, awareness campaigns covering more than 11 universities and over 28 memoranda of understanding with public institutions, private organisations and international partners.
Olatunji also highlighted Nigeria’s participation in international data protection organisations and its role in promoting regulatory harmonisation across Africa.
Speaking at the event, the Administrator of the National Judicial Institute, Justice Babatunde Adejumo, warned that the misuse of personal information could threaten national security, institutional stability and public confidence.
“Illicit actors frequently exploit data to perpetrate heinous acts capable of undermining national sovereignty and crippling public trust in the integrity of governmental institutions,” he said.
Adejumo explained that the judiciary had an important responsibility to protect individuals’ rights to access, correct and erase personal information, as well as object to its processing.
He said courts must also determine liability for data protection violations and balance individual privacy rights against legitimate public interests.
“The Nigeria Data Protection Act 2023 provides a vital legal framework for the protection of personal data in Nigeria, and its implications for public institutions, including the Judiciary, deserve careful consideration,” he stated.
Adejumo urged judicial officers to remain familiar with emerging technologies and international legal principles, noting that increasingly complex data disputes required informed judicial interpretation.
He also called for stronger cooperation among government agencies, saying, “The sheer importance of this subject demands inter-agency partnership and collaboration.”
The administrator commended the Chief Justice of Nigeria, Justice Kudirat Kekere-Ekun, for approving the workshop and acknowledged the contributions of the NDPC and the National Judicial Institute’s education committee to strengthening judicial capacity.