NDPC pushes data protection as business priority

The Nigeria Data Protection Commission has urged organisations to make data protection and regulatory compliance an integral part of their business operations, warning that partnerships with the private sector will not shield violators from sanctions.

The National Commissioner and Chief Executive Officer of the NDPC, Vincent Olatunji, made the call on Wednesday at the opening ceremony of the eighth edition of the Data Protection Africa Summit 2026 in Lagos.

Olatunji said organisations should embrace data protection as a business culture rather than treat compliance as an obligation imposed by regulators.

He said the commission had adopted a public-private partnership model to expand the implementation of the Nigeria Data Protection Act, given the scale of the country’s data protection responsibilities.

According to him, the approach has helped create an economy valued at more than $12bn around data privacy in three years, while generating over 27,000 jobs within the same period.

“From our own experience, because of the PPP model that we adopted, we have now created an economy around data privacy which is worth over $12bn within three years. And I’m not sure of any law that has been able to achieve that in Nigeria,” Olatunji said.

He explained that the model was necessary given Nigeria’s population of more than 230 million, 36 states, 774 local government areas and over 500,000 data controllers and processors.

Olatunji disclosed that the commission had licensed 367 Data Protection Compliance Organisations to provide compliance services to businesses and other institutions.

He said the organisations, which employ between five and 10 people depending on their client base, provide more than 17 services within the data protection ecosystem.

The commissioner added that the number of certified data protection officers in the country had increased from fewer than 1,000 to more than 10,000 through the initiative.

He said the commission had also worked with private sector partners to establish certification processes, including licensing organisations to provide compliance services and another body to conduct certification examinations.

“Our aim and focus is for data controllers to see compliance as a service, as an important component of what they are doing. Having the freedom to choose is invaluable. Let them see it as a culture,” he said.

However, Olatunji cautioned that the partnership approach would not prevent the commission from taking enforcement action against organisations that breach data protection laws.

“We can be partners; we can work together. But the moment you cross that line, you see the real law. You see the other side of us,” he said.

He disclosed that the commission had sanctioned several multinational companies operating in Nigeria for data protection violations but declined to name the affected organisations.

Earlier, Olatunji welcomed delegates from across Africa and Nigeria to the summit, stressing that public awareness and collaboration among stakeholders were essential to strengthening data protection across the continent.

The summit, themed ‘Strengthening Data Protection through Strategic Partnerships’, was declared open by the Data Protection Royal Ambassador for Nigeria and the Alara of Ilara Kingdom, Oba Olufolarin Ogunsanwo.

The Lagos State Governor, Babajide Sanwo-Olu, was represented by his Special Adviser on Technology, Innovation and Broadband, Ganiyu Oseni.