The federal government has launched the Nigerian Data Protection Act General Application and Implementation Directive (NDP ACT-GAID) in its quest towards safeguarding the fundamental rights and freedoms of Nigerians in the context of data privacy and protection.
The Nigerian Data Protection Commission (NDPC) unveiled this important platform in Abuja on Thursday in order to push the country to the frontiers of the 4th Industrial Revolution as envisaged by President Bola Ahmed Tinubu to give effect to the objectives of the Nigeria Data Protection Act, 2023.
National Commissioner/ CEO of NDPC, Dr. Vincent Olatunji, told a news conference in Abuja on Thursday that the NDP Act- GAID addresses technical and organisational measures in areas such as Data Protection Principles, Lawful Bases of Data Processing, Data Subjects’ Rights, Material and Territorial Scope of the NDP Act Data Ethics and Emerging Technologies.
Others include; NDP Act Compliance Audit Returns, Data Privacy Impact Assessment, Cross-border Data Transfer, Training and Certification of Data Protection Officers, Benchmarking with global best practice, Cooperation and Collaboration, Alternative Dispute Resolution, and Standardised Grievances Redress Mechanism.
The NDPC boss noted that in line with the Federal Government’s policy on Enabling Business Environment, the full implementation of the NDP Act will commence in September 2025 – that is after 6 months adding that all provisions relating to fees will commence in January 2026.
He noted that rigorous efforts went into the implementation directive, stressing that this was in line with President Tinubu’s belief that the privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications should be guaranteed and protected in accordance with Section 37 of the Constitution of the Federal Republic 1999 as amended.
Thus, in fulfillment of this constitutional obligation and in line with the Presidential Priority on Rule of Law (Improving Governance for Effective Service Delivery) the Commission has been engaging vigorously with data subjects, constituted authorities, corporate bodies, civil society organisations, international institutions, and the mass media.
Olatunji said “it is worthy of note that the quest for safeguarding privacy rights in the context of emerging technologies such as Artificial Intelligence received attention in the NDP Act GAID. Practitioners in this space are enjoined to implement privacy by design and by default among other obligations.
“Furthermore, we have fully democratised the privacy breach remediation process for data subjects.
We achieved this by introducing data subjects’ Standard Notice to Address Grievance (SNAG) which empowers data subjects to use the instrumentality of the Commission to demand remedial action from data controllers and processors without first writing to the Commission.
“This process makes over 230 million Nigerians our immediate and direct partners in ensuring adequacy of data protection in Nigeria. Through Automation, the SNAG will be accessible anywhere in all nooks and crannies of Nigeria and around the world,” he said.
He highlighted the need to hold data controllers and data processors accountable for their acts and omissions, which affects the rights of others, adding that accountability creates trust for the lawful use of data towards achieving sustainable development.
“The Commission is absolutely committed to this objective of the NDP Act. Our open-door policy ensures that all stakeholders are given equal and equitable opportunity in a manner that respects the rights of individuals and fosters economic growth in Nigeria – for the benefit of all Nigerians. Essential to this economic growth is accountability of players who feel called upon to deal in the personal data of citizens in a manner that may appear to go beyond the confines of the law.
“We are delighted to note that our remedial engagements with Nigerian organisations are yielding positive results gradually. With the issuance of the NDP Act GAID, no organisation can feign ignorance of its obligations under the law,” Olatunji said.
He said further that the Commission shall be providing guidance notices and advisories to illustrate the requirements of law towards deepening the culture of data privacy and protection and also carry out various capacity building programmes.
