NDPC Warns States Against Weak Data, Privacy Protection 

States that fail to establish strong data protection and privacy systems risk weakening investor confidence and losing investment opportunities as economic activities become increasingly digital, the Nigeria Data Protection Commission has warned.

The National Commissioner and Chief Executive Officer of the NDPC, Vincent Olatunji, said effective protection of personal data could improve the credibility of states, strengthen public trust and make them more attractive to foreign investors.

He spoke on Wednesday in Abuja at a data privacy implementation workshop for state governments organised by the NDPC in collaboration with the Nigeria Governors’ Forum.

Olatunji said the growing movement of personal and commercial information across borders had made data protection an important consideration for businesses seeking to invest or enter partnerships.
He said, “A lot of countries that don’t have your data protection law, no party is ready to do business with you. Because if there’s possible to transfer data, how are they going to ensure that data is in Nigeria?”

According to him, effective implementation of the Nigeria Data Protection Act at the state level would strengthen credibility, public confidence and investment prospects.

“It builds trust and confidence that, yes, what we are doing with these states, we are secure, we are safe,” Olatunji said, adding that stronger compliance could boost foreign direct investment by assuring investors that their information would be protected.
He explained that states are major data controllers because their ministries, departments and agencies collect large volumes of information in providing public services and employing workers.

Olatunji urged state governments to move beyond discussions and establish frameworks, policies and institutional structures for implementing the national law rather than enact separate state data protection laws.

“We want to see action at the state level in terms of compliance,” he said.

The NDPC boss said Nigeria’s privacy ecosystem had expanded considerably, with more than 38,000 organisations registered with the commission as of last year and 346 licensed data protection compliance organisations.

He added that the number of people working in the ecosystem had risen from fewer than 1,000 to more than 27,000 within three years, including over 10,000 certified data protection officers.

“From less than 1,000, in three years, we have over 27,000 people working within this ecosystem. It speaks to the benefit that states can even achieve in terms of job creation, in terms of revenue,” Olatunji said.

Also speaking, the Minister of Communications, Innovation and Digital Economy, Bosun Tijani, warned that inadequate privacy protection could slow investment and Nigeria’s digital development.
Tijani, who was represented by the ministry’s Permanent Secretary, Nadungu Gagare, said physical digital infrastructure alone would not deliver a competitive digital economy without public and investor confidence.

“Trust is the bedrock currency that powers it all. Without a secure and privacy-compliant environment, citizen engagement stalls, investment slows, and digital progress is compromised,” he said.
He noted that the Nigeria Data Protection Act 2023 provided the legal foundation while the General Application and Implementation Directive 2025 provided an operational framework for data governance across different levels of government.

The minister urged states to align their regulatory systems with the national framework, saying this would “provide the legal clarity necessary to attract private capital and foster innovation.”

The Director-General of the Nigeria Governors’ Forum, Abdulateef Shittu, represented by the forum’s General Counsel, Chijioke Chuku, said states were indispensable to the creation of a credible national data protection system.

“As government becomes increasingly digital, citizens must remain confident that innovation will not come at the expense of their privacy, security, or trust,” he said.

Shittu said the NGF-NDPC partnership was aimed at providing states with a common implementation platform, improving institutional understanding and promoting consistency in compliance.
Similarly, the Head of the Civil Service of the Federation, Didi Walson-Jack, represented by Joy Baderin, Director Overseeing the Office of the Permanent Secretary, Special Duties Office, said responsible handling of personal information had become central to effective governance.

She urged state governments to translate lessons from the workshop into measures that would “safeguard citizens’ personal data and strengthen public trust in governments and institutions.”

The Deputy Governor of Kano State, Murtala Garo, said state governments handled enormous volumes of personal information across education, healthcare, taxation, social protection, civil registration, employment and security.

“Citizens entrust us with their sensitive information. This trust places a corresponding responsibility on us to ensure that such information is handled lawfully, responsibly, and securely,” Garo said.

He called for practical measures including staff training, stronger data security and access controls, proper data retention, breach management and responsible information sharing.

“Technology should make government more efficient and accessible without compromising the fundamental right of our people,” he added.

The Chairman of the Association of Licensed Data Protection Compliance Organisations of Nigeria, Ivan Anya, said every state had effectively become a major producer of data and therefore required sustainable structures for its protection.
“This data is present in every state. So, every state is now a major producer,” Anya said, calling for actionable plans to ensure safe processing of information and safeguard citizens’ constitutional right to privacy.

The President of the Data & Knowledge Information Privacy Protection Initiative, Tokunbo Smith, described data protection as a global issue that could affect Nigeria’s international image if institutions failed to comply with established standards.

“It’s not just filling the form that matters to us. Also, you must demonstrate real compliance right from the beginning to the end of the audit,” Smith said.

He urged government institutions to cooperate with the NDPC and licensed compliance organisations to ensure effective implementation of the Data Protection Act and accompanying guidelines.