NDPC Boss Harps on Need for Data Compliance in Public and Private Sectors

Nigeria Data Protection Commission (NDPC) Commissioner (NDPC), Dr Vincent Olatinji has called upon both the public and private sector organizations on data compliance to reinforce data privacy and protection practices in the country.

Given the growing concern over data privacy compliance, the NDPC Boss who stressed the need to be data compliant said global bodies and international investors now consider data protection legislation and level of data compliance as standard requirements for investments.

Data compliance is a process that identifies the applicable governance for data protection, security, storage and other activities and establishes policies, procedures and protocols ensuring data is fully protected from unauthorized access and use, malware and other cybersecurity threats.

To achieve its aim, Olatunji disclosed the commission carries out compliance for organisations and over 160 data compliance monitoring organisations (DCMOs) and Data Protection Compliance Organisations {DPCOs) been licensed.

Speaking with selected media, Olatunji in Nigeria the level of data compliance by private sector organizations currently stands at 49%, while public sector data compliance stands at 9%. According to him, this is necessary because it gives investors the confidence needed.

To fill the skill gaps, he also noted that over 100 Data Protection Officers (DPOs) have been trained and the commission will partner with Data Protection Compliance Organizations (DPCOs) in training 500,000 young Nigerians who are interested in building careers in data protection privacy ecosystem.

On the Nigeria Data Protection Act 2023, he said the new law signed in early June by President Bola Tinubu is a significant shift to regaining global confidence not only in Nigeria’s emerging digital economy but also in the new efforts of the current administration to drive development and boost the economy with investments and new jobs. The Nigeria Data Protection Act 2023 will improve the country’s global data privacy ranking and endear it to international investors.

Also Read: Data Sovereignty, Compliance Issues Tops IT Decisions

According to Olatunji, “One of the responsibilities of the Commission is to promote the advancement of technologies that protect personal data, following established international standards, and to ensure that data protection obligations are met.”

To this effort, he said the commission will be working to firm up on an implementation of a standardised framework allowing every part and section of the law to be broken down into specific activities for people to fully understand “what we intend to do going forward with the law that Mr President has graciously signed.” The objective is to ensure consistency and clarity concerning the implementation of data protection standards across all sectors all of which will involve issuing guidance notices on key provisions of the law as they relate to the lawful basis of data processing, data subjects’ rights, compliance audit returns, and cross-border data transfer.

According to Dr. Olatunji, “The Commission is committed to promoting a culture of data privacy and data protection, and to ensure that Nigerian private and public organisations align with national laws and acts concerning data protection.”

He added, “We are fully aware of this responsibility and will not hesitate to penalize any organization that fails to comply with these laws. We aim to create a safe environment for organizations and instil confidence in data subjects conducting business in Nigeria.”

Fines and Sanctions

While stating that the NDPC is more interested in compliance than in penalizing non-compliant organisations, the commissioner disclosed that the commission will now hold chief executives of government Ministries, Agencies, and Departments (MDAs) responsible for any data breach that occurs under their watch.

Olatunji stated that “there are provisions in the law that even the CEO of an MDA could be jailed if there is a data breach with impact on the data subject. We have also issued a circular to the effect that all MDAs must appoint a resident Data Protection Officer (DPO) and ensure that they train all their staff to understand what data protection is and also to make appropriate budget provisions for data protection.

“So, we are expecting the level of compliance by MDAs to increase from now. We are also creating awareness to ensure that all MDAs comply with the provisions of the law.

“With Data Controllers dealing with more than 10,000 Data Subjects, the NDPR stipulates the payment of a fine of 2% of the organization’s annual gross revenue of the preceding year or the payment of the sum of N10 million, whichever is greater.

“In the case of a Data Controller dealing with less than 10,000 Data Subjects, the sanction involves the payment of a fine representing 1% of the organization’s annual gross revenue of the preceding year or payment of the sum of N2,000,000.00 (two million Naira) (approx. EUR 2,000), whichever is greater,” he said.