Data Protection Risk in Nigerian M&A
Introduction
In contemporary mergers and acquisitions (M&A), the focus of transaction teams has traditionally centred on valuation, financing structure, tax efficiency, and regulatory approvals. Personal data protection, while not excluded during the due diligence considerations had, prior to the enactment of the Nigeria Data Protection Act, 2023 (the “NDPA”) rarely featured as a distinct work stream. The introduction of a comprehensive data protection framework in Nigeria, coupled with the increasing commercial value of personal data and heightened regulatory enforcement, has fundamentally altered this position. Personal data is now recognised not only an operational asset but also as a significant source of legal and regulatory risk capable of affecting valuation, deal certainty, and post acquisition integration.
