Policy & Regulation

FG, NGF, NDPC Urge Nigerian States to Enforce Data Law

August 21, 20264 min read

By Lina Petrov — 8 years reviewing consumer technology

FG, NGF, NDPC Urge Nigerian States to Enforce Data Law

A Joint Call for State-Level Compliance

The Federal Government, the Nigerian Governors Forum (NGF), and the Nigeria Data Protection Commission (NDPC) delivered a unified message this week: state governments across Nigeria need to move faster and more decisively on implementing the Nigeria Data Protection Act, 2023. The message came out of a workshop organized by the NDPC specifically aimed at helping subnational governments understand and act on their obligations under the law.

During the session, officials stressed that the responsibility for protecting citizens' personal information cannot rest solely at the federal level. A government minister reportedly emphasized the importance of taking the data protection message down to the subnational level, noting that ordinary citizens need to understand what the law means for them in practice, not just in theory. The NGF's leadership reportedly pledged support for helping states align with the framework, signaling that this is meant to be a coordinated national effort rather than a top-down mandate.

Why the Nigeria Data Protection Act Matters for Citizens

The Nigeria Data Protection Act, 2023 provides the legal backbone for how personal information should be collected, stored, and used by both government agencies and private organizations. It gives Nigerians rights over their own data, similar in spirit to concepts like the right to be forgotten, which allows individuals to request that their personal information be removed from databases and online platforms under certain conditions.

But a law is only as strong as its enforcement. If state ministries, agencies, and parastatals that handle sensitive citizen data such as health records, tax information, and identity documents aren't held to consistent standards, the protections on paper mean little in practice. That's the gap officials say they are trying to close. One point raised during the discussions is particularly telling: a state cannot reasonably expect private businesses and startups operating within its borders to comply with data privacy rules if the state's own ministries aren't following the same standards internally.

This isn't an abstract concern. Around the world, organizations that fail to secure customer and citizen data have faced serious consequences. The recent case involving Australia's Origin Energy, where a hacker threatened to leak millions of customer files, is a stark reminder of what's at stake when data protection practices lag behind the volume of sensitive information being collected and stored. Nigerian officials appear keen to avoid similar scenarios by getting ahead of compliance gaps now rather than reacting after a breach.

Closing the Implementation Gap

One of the persistent challenges with data protection laws globally, not just in Nigeria, is the distance between passing legislation and actually enforcing it. The Data Protection Act has been in place since 2023, but the workshop this week suggests that many state governments still need clearer guidance on practical steps: appointing data protection officers, auditing how citizen data is collected and stored, and building internal policies that meet the law's standards.

Technical safeguards matter here too. Proper implementation typically involves basic but essential practices like encryption of sensitive records, so that even if data is intercepted or improperly accessed, it remains unreadable without the correct key. Whether state agencies are currently applying these kinds of safeguards consistently is exactly the sort of operational detail that oversight bodies like the NDPC are now pushing states to address.

What This Means For You

If you're a Nigerian citizen, this development is a signal that your personal data, whatever a state government agency holds on you, is supposed to be governed by enforceable rules, not just good intentions. It also means you may have more recourse than you realize if you believe your data has been mishandled by a government body or a business operating under state jurisdiction.

For businesses and public sector organizations operating in Nigeria, the message is equally clear: compliance with the Nigeria Data Protection Act isn't optional, and the federal government appears to be increasing pressure on states to model the standard they expect from the private sector.

Actionable Takeaways

Stay informed about how your state government is rolling out compliance with the Nigeria Data Protection Act, since implementation details can vary from state to state. If you interact with government services that require sharing personal information, ask what data protection measures are in place. And if you run a business or organization, treat this news as a prompt to review your own data handling practices now, rather than waiting for a Nigerian data protection law implementation deadline or an incident to force the issue.

// FAQ

Why are Nigerian states being urged to enforce the Nigeria Data Protection Act?

Officials say the responsibility for protecting citizens' data cannot rest solely at the federal level. State ministries that handle sensitive information must follow the same standards, or the protections in the law mean little in practice.

What does the Nigeria Data Protection Act, 2023 do?

It provides the legal framework for how personal information should be collected, stored, and used by government agencies and private organizations. It also gives Nigerians rights over their own personal data.

What happened at the NDPC workshop?

The Federal Government, NGF, and NDPC held a workshop to help state governments understand and act on their obligations under the data protection law. Officials stressed the need to take the data protection message down to the subnational level, and the NGF pledged support for helping states align with the framework.

What rights do Nigerians have under the data law?

The law gives Nigerians rights over their own personal information, similar to the right to be forgotten. This allows individuals to request that their personal information be removed from databases and online platforms under certain conditions.

Why did officials mention the Origin Energy case?

They cited it as an example of the serious consequences that can occur when data protection practices lag. In that case, a hacker threatened to leak millions of customer files, highlighting the importance of getting ahead of compliance gaps.