Written Policy, Broken Practice: The Data Protection Gap

Nigeria’s digital economy is expanding at a remarkable pace. By February 2025, there were over 430 fintech companies operating in the country, and the Nigeria Inter-Bank Settlement System Plc(NIBSS) processed ₦600 trillion in electronic payments, reflecting a 55% year-on-year increase. As digital activity rises, so does exposure to data risks, bringing with it, legal responsibilities that organisations can no longer ignore or downplay.

The introduction of the Nigeria Data Protection Act 2023 marks a major shift in the country’s data governance landscape, building on the earlier Nigeria Data Protection Regulation of 2019. The Actestablishes a comprehensive statutory framework, backed by an independent Commission with powers to investigate, impose fines, and enforce compliance. It also reinforces data subject rights anchored in Sections 37 and 45 of the 1999 Constitution of the Federal Republic of Nigeria. Enforcement has become more tangible, with significant penalties already issued,