NDPC investigates 240 data breach cases, flags 1,900 firms over non-compliance

The Nigeria Data Protection Commission (NDPC) says it has investigated more than 240 data breach cases and identified over 1,900 organisations for failing to comply with data protection regulations.

Vincent Olatunji, the commission’s National Commissioner and Chief Executive Officer, disclosed this on Thursday in Abuja at a two-day capacity-building workshop organised in collaboration with the National Judicial Institute (NJI) for judicial officers.

Olatunji said the commission had also issued more than 20 major remediation orders to strengthen compliance with data protection regulations.

He added that the NDPC had registered over 41,000 data controllers and processors of major importance in the last three years and received more than 8,000 compliance audit returns.

According to him, the commission has licensed 367 data protection compliance organisations to support enforcement and compliance efforts across the country.

Olatunji also disclosed that the NDPC had issued the General Application and Implementation Directive under the Nigeria Data Protection Act 2023.

He said the legislation had been translated into Yoruba, Igbo and Hausa to make its provisions more accessible to Nigerians.

The NDPC chief executive noted that the increasing use of digital platforms, electronic transactions and virtual court proceedings had heightened the need to protect personal information against misuse.

He cited Section 37 of the 1999 Constitution, which guarantees citizens’ right to privacy, as a foundation for protecting personal information, adding that the Data Protection Act provides additional safeguards and mechanisms for addressing violations.

Olatunji emphasised the judiciary’s role in resolving disputes arising from the commission’s enforcement activities.

He explained that Section 50 of the Act allows anyone dissatisfied with an order issued by the commission to seek judicial review within 30 days.

He also called for stronger alignment with international data protection standards, including the European Union’s General Data Protection Regulation and relevant African and ECOWAS frameworks.

Misuse of personal data threatens national security

Olatunji said Nigeria’s data protection ecosystem had generated more than 27,000 jobs.

He added that over 1,500 data protection officers had received certification through a national programme, while another 5,000 people had obtained certifications through private initiatives.

According to him, the commission’s Virtual Privacy Academy had reached more than 66,000 people.

He further listed the establishment of 19 university privacy clubs, awareness campaigns across more than 11 universities and over 28 memoranda of understanding with public institutions, private organisations and international partners among the commission’s achievements.

Also speaking, Babatunde Adejumo, Administrator of the National Judicial Institute, warned that the misuse of personal information could threaten national security, institutional stability and public confidence in government.

Adejumo said individuals who unlawfully exploit personal data could undermine national sovereignty and erode trust in public institutions.

He noted that the judiciary had a responsibility to protect individuals’ rights to access, correct and erase their personal information, as well as object to its processing.

He added that courts must determine liability for data protection violations while balancing individuals’ privacy rights against legitimate public interests.

The NJI administrator said the Nigeria Data Protection Act 2023 provides a legal framework for protecting personal information, stressing that its implications for public institutions, including the judiciary, require careful consideration.

He urged judicial officers to keep abreast of emerging technologies and international legal principles to enable them to address increasingly complex data protection disputes.

Adejumo also called for stronger collaboration among government agencies, describing inter-agency cooperation as essential to tackling data protection challenges.

He commended Kudirat Kekere-Ekun, Chief Justice of Nigeria, for approving the workshop and acknowledged the contributions of the NDPC and the NJI’s education committee to strengthening judicial capacity.