NDPC Judgment Will Reshape Corporate Data Governance – Expert

Technology expert and CEO of Computics Limited, Moses Braimah, has said the recent Federal High Court judgment affirming the regulatory powers of the Nigeria Data Protection Commission (NDPC) under the Nigeria Data Protection Act (NDPA) 2023 will redefine corporate data governance, strengthen investor confidence and deepen digital trust in Nigeria.

Speaking in Lagos, Braimah, who is also executive project director of Pacific Messages, said the judgment in Emmanuel Harunna v. Nigeria Data Protection Commission (NDPC) reinforces the Commission’s authority to regulate major data controllers and processors, including decentralised Point-of-Sale (PoS) agent networks.

He described the ruling as a defining decision, as businesses can no longer treat data protection as a routine information technology function.

“Nigeria’s data economy will never be the same again. The court affirmed the Commission’s authority under the Nigeria Data Protection Act (NDPA) 2023 to regulate major data handlers, including decentralised Point-of-Sale (PoS) agent networks,” he said.

Braimah noted that the judgment provides the NDPC with stronger legal backing to enforce compliance across Nigeria’s digital ecosystem, exposing organisations that violate the Act to significant financial and reputational risks.

He explained that the NDPA empowers the Commission to impose administrative penalties of up to ₦10 million or two per cent of an organisation’s annual gross revenue, depending on the nature of the violation.

According to him, “Data governance has become corporate governance. Companies with weak data controls now risk more than regulatory fines; they risk losing investor confidence, strategic partnerships and customer trust.”

He added that the ruling would also stimulate growth in Nigeria’s privacy and cybersecurity ecosystem, as organisations classified as Data Controllers or Data Processors of Major Importance would be required to register with the NDPC, conduct periodic compliance audits and strengthen internal governance frameworks.

Similarly, he added that the development would increase demand for licensed Data Protection Compliance Organisations (DPCOs), cybersecurity professionals, privacy lawyers, compliance auditors and certified Data Protection Officers.

He further stated that the judgment would enhance consumer protection by strengthening regulatory oversight of both formal institutions and informal agent networks, helping to curb identity theft, misuse of personal data and abusive digital lending practices.

“Privacy is no longer merely a compliance issue; it is becoming a practical consumer protection tool and a cornerstone of digital trust,” he said.

Meanwhile, he maintained that the judgment also sends a positive signal to global investors that Nigeria is aligning its data protection regime with international best practices.

“The court has spoken. Smart organisations will not merely comply but they will compete by building trust,” Braimah added.