Background
The most critical element on which the digital economy is predicated is undoubtedly trust. Users of the digital space are encouraged to patronise digital channels and tools such as online payment, cloud-based services, and artificial intelligence (AI) applications because they are confident that their personal data will be received, processed, and protected safely and with integrity. This is why the National Data Protection Commission (NDPC), the brainchild of the Nigeria Data Protection Act 2023 (NDPA), must assume a larger responsibility beyond that of a traditional regulator. It needs to position itself as a key enabler for nurturing a culture of digital trust required to attract investment and sustainable economic development.
Needless to say, the NDPA represents Nigeria’s best effort yet to embody its hitherto fragmented data privacy rules and regulations into a single comprehensive enactment. In doing so, it has demonstrated that data privacy preservation is no longer an isolated compliance function, but an increasingly important feature of sound corporate governance practice. The Act creates the NDPC as an independent institution charged with supervising and monitoring compliance, data governance, the protection of data subjects’ rights, and the promotion of Nigeria’s digital economy. The robust framework established under the NDPA to guarantee corporate and individual rights makes it abundantly clear that privacy protection has been mainstreamed within Nigeria’s jurisprudence.
The advent of the NDPA and the NDPC to Nigeria’s legal infrastructure is not the genesis of the protection of privacy rights. That credit rightly goes to Section 37 of the Constitution of the Federal Republic of Nigeria, which guarantees the privacy of citizens, their homes, and communications. Consequently, the NDPA has operationalised an existing constitutional obligation in a world increasingly governed by data intelligence. The NDPC, it would seem, recognises its role in complementing both constitutional protections and Nigeria’s wider international human rights commitments.
Cultural Shift
It is submitted that the NDPC’s most significant hurdle is not enforcement. It is cultural transformation.
Many organisations continue to engage the privacy question as a box-ticking exercise, where all that’s required is to ensure compliance through documentation collation, issuance of privacy notices, data processing agreements, and filing obligatory compliance reports. While these steps are no doubt a fundamental aspect of the NDPC’s work, they signal only the more visible aspects of effective data governance. The NDPA is founded on much broader principles of fairness, accountability, risk mitigation, transparency, and the imperative of ensuring that data privacy considerations are embedded in how business decisions are adopted and executed, rather than through the narrow prism of drafting privacy compliance policies. This has significant ramifications for an enhanced corporate governance framework.
Going forward, Boards would be abdicating their duties if they regarded data protection as solely the responsibility of the information technology or legal departments. The reasons are not far-fetched. Privacy breaches, cybersecurity risks, ransomware attacks and AI-related risks now present enterprise-wide risks capable of harming operations, reducing shareholder value and damaging corporate reputation. Sections 305 to 311 of the Companies and Allied Matters Act 2020 address the fiduciary duties of a Nigerian director. Section 305 is the bedrock provision that codifies a director’s core duty to act in good faith and in the company’s best interests. It is safe to argue that directors are increasingly unable to discharge this critical obligation meaningfully without targeted oversight of digital governance. Data governance has, indeed, become an inexorable part of corporate governance.
This evolution is consistent with global developments in Environmental, Social and Governance (ESG) reporting. It is now commonplace for institutional investors to evaluate target companies not only on financial performance but also on sound corporate governance metrics, advanced cyber preparedness, AI ethical practices, and responsible stewardship of stakeholder data. The guardrails established by the International Financial Reporting Standards (IFRS) Sustainability Disclosure Standards underpin the link between robust governance structures and corporate sustainability. In the digital economy, data oversight and control have become an indispensable part of sound corporate governance rather than an ancillary regulatory conversation.
The introduction of artificial intelligence further magnifies this responsibility. While AI systems rely heavily on data, they also unwittingly attract new risks around system-generated outcomes, algorithmic bias, transparency and accountability. This reinforces why data privacy and protection need a firm handshake with AI governance in Nigeria. A useful illustration of this is the concept of Privacy by Design, embedded in Article 25 of the EU General Data Protection Regulation (GDPR), which requires privacy safeguards to be incorporated into systems from inception rather than reconstructed after deployment. It is noteworthy that the NDPC has endorsed this philosophy through its own Privacy by Design in Early-Stage Innovation White Paper, demonstrating that innovation that has regard for ethical considerations and not merely concerns of regulatory compliance will define Nigeria’s digital landscape.
Growing global practices buttress this view. The GDPR has shown that sound privacy laws and innovation are not mutually exclusive. They can, indeed, co-exist where organisations encourage risk-based governance as opposed to document-checking compliance procedures. In the same vein, the Organisation for Economic Co-operation and Development (“OECD”) Privacy Guidelines and OECD AI Principles highlight accountability, transparency and responsible stewardship as foundational elements of digital governance. The United Nations Educational, Scientific and Cultural Organization’s (“UNESCO”) Recommendation on the Ethics of Artificial Intelligence equally highlights human rights, privacy and accountability as the nerve centre of responsible AI practices. It is reassuring to observe that Nigeria has adopted this global mindset and set of standards while adapting them to local realities.
Unsurprisingly, this alignment is significant for investors. Data governance is no longer a mere nice-to-have but a must-have in transactional due diligence. Funders, investors, and acquirers are increasingly placing a premium on the durability of cybersecurity, the robustness of privacy compliance, AI governance, and how effectively systems can respond to vulnerabilities as indicators of enterprise value. Where the governance structures in these areas are weak, they can create liabilities that survive acquisitions, disrupt commercial transactions and diminish investors’ confidence.
The NDPC itself appears to appreciate that a sanctions regime is not a silver bullet. This is perhaps why, in its Strategic Roadmap and Action Plan 2023–2027, tremendous value is accorded to public advocacy, corporate capacity building, regulatory guidance, and stakeholder engagement alongside enforcement. This demonstrates an appreciation that a sustainable regulatory environment depends as much on grassroots mobilisation and partnerships as on investigation and sanctions.
In the final analysis, the Commission’s legacy should not be gauged by the number of violations it identified, or the number of sanctions meted out to erring parties, but by how deeply it transformed corporate behaviour to prioritise sound data governance ethics. The institutionalisation of this culture in our corporate landscape would encourage executives and non-executive directors to interrogate cyber risks and AI systems routinely; employees to instinctively protect their personal information; and consumers to trust organisations with their data because that trust has been earned.
Now that the NDPA has provided the legal architecture, the NDPC has the daunting task of promoting a governance environment in which trust in our digital assets is elevated to a competitive advantage rather than a regulatory pastime. It is hoped that the Commission’s journey to that desired destination of becoming a trusted and competitive global digital stakeholder will not be a protracted one but an organic progression from a mere industry watchdog to an investment enabler.
Simeon Oyakhilome Okoduwa is the managing partner at The Timeless Practice
