Intelligence

Day after day, an increasing number of businesses are incorporating Artificial Intelligence (AI) tools and systems into their operations to process customers’ personal data, analyse information, and automate decision-making processes. The reason for this growing adoption is not difficult to appreciate, as AI tools/AI systems are capable of processing, analysing, and extracting insights from vast and complex datasets with precision, consistency, and objectivity in seconds, far beyond human capabilities if replicated within the same timeframe.

In today’s digital-first legal environment, data has become one of the most valuable and strategic assets of a law firm. Law firms routinely handle highly sensitive information, including client records, litigation documents, contracts, financial information, documentation evidencing intellectual property assets, personal data, and confidential communications.

The Nigeria Data Protection Act and the General Application and Implementation Directive provide a comprehensive legal framework for the protection of personal data in Nigeria. The Act applies its provisions to data controllers and processors domiciled, resident, or operating in Nigeria, with the principal exception being processing undertaken solely for personal or household purposes.

The Federal High Court has affirmed the statutory powers of the Nigeria Data Protection Commission (NDPC) to register Data Controllers and Data Processors of Major Importance (DCPMIs) under the Nigeria Data Protection Act (NDPA), 2023. In a judgment delivered on 28 July 2026 by Honourable Justice F.N. Ogazi in Emmanuel Harunna v. Nigeria Data Protection Commission (FHC/L/CS/1116/2024), the court dismissed the applicant’s contention that Point of Sale (PoS) agents should not be classified as Data Controllers or Processors subject to the Commission’s registration regime.

The Nigeria Data Protection Commission's controversial Guidance Notice requiring registration of Data Controllers and Processors of Major Importance sparked legal challenges and widespread debate over regulatory authority, privacy rights, and compliance obligations. A landmark Federal High Court ruling has now clarified the scope and validity of these registration requirements, establishing binding precedent on who must register and under what circumstances.

Nigerian data protection law remains silent on what happens to personal data after death, creating a legal vacuum that has allowed the posthumous exposure of sensitive information belonging to prominent figures. This article examines whether privacy rights should extend beyond biological death, drawing on recent high-profile cases and proposing legislative reforms to protect the deceased and their surviving families.