Data Protection Compliance: NDPC Gives Banks, Telcos, Others 6 Months To Register

The Nigeria Data Protection Commission (NDPC) has granted a window grace period of six months to telecom providers, banks, and other institutions that hold Nigerians’ data to register with the commission.

Recall that president Bola Tinubu signed the country’s Data Protection Bill into law on June 12 this year.

The national commissioner, NDPC, Dr. Vincent Olatunji, who gave the order, at a sensitisation forum on the Nigeria Data Protection Act, said this is in line with the provisions of the Act which mandates all data controllers and data processors to get registered within six months of the enactment of the law.

He added that, all the registered organizations will also be required to file their annual audit report with the commission between January and March next year.  

While noting that the Commission is also increasing awareness to let Nigerians know their rights when it comes to their data, Olatunji said the registration of all organizations handling data is to ensure that the rights are preserved by all data processors and controllers in Nigeria.  

“What we have in the law is that all data controllers and processors and there are over 500,000 in Nigeria, that they should register with the data protection authority. What the law says is that we should give them six months to acquaint themselves with the provisions of the law.  

“That is why we are carrying out awareness across the country, we are going to do another one in Abuja very soon. The data controllers need to register with us because you can’t count them if you don’t know them. So, we need to have a number, and then those that are captured will be monitored to see how they are managing the data in their care and we can regulate them appropriately. Between now and December 31, they are to register with the commission.

“And from the first of January to the 31st of March next year, they are to submit their annual audit report, telling us what they have done in the area of putting in place measures to safeguard our data with them,” Olatunji further explained. 

According to Olatunji, every Nigerian is a data subject as they all have data with either the government or private organisations. Highlighting the rights of data subjects, he said: “Data subjects have the right to give their consent or not when their data is being collected; the right of rectification where data is not correct.

“They also have the right of portability, that is to be able to move their data from one data controller to another.

“On the part of data controllers and data processors, they owe us the duty of care and accountability to ensure that the data with them is well protected.

“What kind of measures are they putting in place in terms of technological measures; in terms of organisation measures for them to ensure that the data with them is secure.” 

The NDPC boss stated that, one of the aims of the data protection law is to create confidence and trust in the economy and to attract foreign direct investments in Nigeria.  

“For a lot of countries, if you don’t have a data protection law and a data protection body, they don’t want to do business with you.

“But with this law, an average investor coming to Nigeria will know that we have the law and we have an independent data protection authority and if there is any breach of your personal data you have someone to go to,” he said.

President Bola Tinubu signed the country’s Data Protection Bill into law on June 12 this year.

This transformed the existing National Data Protection Bureau headed by Olatunji into a Commission that will be driving the implementation of the law.

According to Olatunji, to underscore the importance of the data protection law to Nigeria’s economy, the World Bank has been funding the ongoing awareness about the Act.