The Nigeria Data Protection Commission (NDPC) has urged organizations in the country to appoint data protection officers within six months. Dr. Vincent Olatunji, the National Commissioner and CEO of NDPC, emphasized the importance of this measure in light of the substantial amount of data generated daily in Nigeria as the appointment of in-house data protection officers will help ensure compliance with data protection regulations and enhance data security.
He says according to Section 32 of the law, every organization in Nigeria must appoint a data protection officer, which is a requirement for compliance. Failure to do so constitutes a breach of the law. After the law takes effect, organizations will be given a six-month period to comply with this regulation. It is essential for organizations to register with the NDPC and this requirement applies to both public and private institutions, including telcos, insurance, hotels, hospitals, pharmaceuticals, and manufacturing firms.
According to him, a survey revealed that there are over 500,000 Data Processors and Controllers in Nigeria who are required to have a Data Protection Officer (DPO). However, the number of certified DPOs in the country is less than 10,000. This presents a challenge in meeting the demand for qualified DPOs.
He emphasized the importance of capacity building to address this gap and meet the market’s needs. He also highlighted that individuals from various backgrounds, such as legal practitioners and doctors, can become DPOs by attending training, passing exams, and acquiring the necessary skills.
Additionally, the licensing of Data Protection Compliance Organisations (DCPOs) provides further job opportunities in compliance.
The CEO emphasized that organizations have six months to comply and appoint a Data Protection Officer (DPO). All data-related activities of organizations in the country must be submitted to the commission between January 1 and 31, 2024. He highlighted that the readiness of the digital economy is not dependent on its sophistication but on the legal aspects of data collection, storage, and sharing.
The commission encourages Nigerians to report compliance issues through social media or the commission’s portal. He mentions that the commission has already investigated and fined three banks even before the data protection law was implemented. The creation of the commission is in response to the global shift towards digital economies and the recognition of data protection as a crucial aspect.
The CEO stated that Nigeria is prepared for a data revolution due to its large population and high internet usage, emphasizing the need for a data protection law as data privacy is now considered a human right globally. The commission operates as a self-funded organization without cost to the government.
He says due to the country’s technological development and population, they have implemented a PPP model to address the challenges of effective regulation implementation. Under this model, DPCOs are licensed to provide compliance services for organizations, enabling them to adhere to the law’s provisions. These organizations are required to pay licensing fees and file yearly reports, generating revenue through grants and fines.
According to him, in less than a year, they have already generated over N200 million without a law in place. With the law now established, any breach in data privacy and protection can result in significant penalties. The recent directive by the Central Bank of Nigeria mandating customers to submit their social media handles will be addressed in accordance with the law, ensuring the protection of citizens’ interests and adherence to necessary data collection practices.
