Nigerian businesses could face tougher regulatory scrutiny as the Nigeria Data Protection Commission intensifies efforts to make data privacy a core part of corporate operations, warning that its partnerships with private organisations will not protect companies that violate the law.
The commission also disclosed that Nigeria’s data protection industry had grown into an economy worth more than $12bn within three years, creating over 27,000 jobs through its public-private partnership model.
The National Commissioner and Chief Executive Officer of the NDPC, Vincent Olatunji, disclosed this on Wednesday at the opening of the eighth edition of the Data Protection Africa Summit 2026 in Lagos.
Information gathered by Bzzyer from the summit proceedings showed that the commission wants businesses to move away from treating data protection as a regulatory formality and instead integrate privacy safeguards into their everyday operations.
Olatunji said the commission adopted a public-private partnership model to implement the Nigeria Data Protection Act more effectively, given the country’s population of more than 230 million, 36 states, 774 local government areas and over 500,000 data controllers and processors.
According to him, the approach has created a $12bn data privacy economy within three years, while generating more than 27,000 jobs.
“From our own experience, because of the PPP model that we adopted, we have now created an economy around data privacy which is worth over $12bn within three years. And I’m not sure of any law that has been able to achieve that in Nigeria,” he said.
NDPC licenses 367 compliance organisations
The commissioner disclosed that the NDPC had licensed 367 Data Protection Compliance Organisations to provide regulatory compliance services to businesses and other institutions.
These organisations employ between five and 10 people, depending on their client base, and provide more than 17 services across the data protection ecosystem.
He also revealed that the number of certified data protection officers in Nigeria had increased from fewer than 1,000 to more than 10,000 through the commission’s initiatives.
The NDPC has also collaborated with private-sector partners to establish certification processes, including licensing organisations to provide compliance services and another institution to conduct certification examinations.
Olatunji said the commission wanted businesses to recognise compliance as a professional service and an essential component of their operations rather than an obligation they fulfil only when regulators demand it.
“Our aim and focus is for data controllers to see compliance as a service, as an important component of what they are doing. Having the freedom to choose is invaluable. Let them see it as a culture,” he said.
NDPC threatens sanctions despite private-sector partnerships
Despite its collaboration with private organisations, the commission warned that it would not hesitate to sanction businesses that breach Nigeria’s data protection laws.
Olatunji said the partnership model was designed to expand compliance and improve industry capacity, not weaken regulatory enforcement.
“We can be partners; we can work together. But the moment you cross that line, you see the real law. You see the other side of us,” he warned.
He further disclosed that the commission had sanctioned several multinational companies operating in Nigeria over data protection violations, although he declined to identify the affected organisations.
The warning comes as businesses increasingly depend on digital platforms to collect customer information, process payments, manage transactions and deliver services.
For Nigerian companies, particularly banks, fintechs, telecommunications operators, e-commerce platforms and technology startups, customer information has become a valuable business asset. However, mishandling that information could expose organisations to regulatory penalties, reputational damage and declining consumer confidence.
The NDPC’s position signals that companies can no longer separate data privacy from their broader business strategies.
Why data protection is becoming a business issue
Nigeria’s expanding digital economy has increased the amount of personal information organisations collect and process, making data protection an increasingly important part of commercial operations.
For example, a fintech company handling customer transactions, an online retailer collecting delivery addresses or a telecommunications operator managing subscriber information all have responsibilities under the country’s data protection framework.
A data breach could go beyond exposing customers’ personal information. It could undermine trust, disrupt business operations and discourage people from using digital services.
This creates an additional challenge for Nigerian businesses trying to attract customers in a market where confidence in digital transactions remains important.
The commission’s growing network of compliance organisations and certified officers could help businesses access professional support without building entire regulatory departments from scratch.
However, the effectiveness of the arrangement will depend on whether organisations treat compliance as an ongoing operational responsibility rather than a certificate displayed to satisfy regulators.
The NDPC’s approach also places greater responsibility on company management, as data protection requires investment in staff training, secure systems, internal policies and regular assessments.
Data Protection Africa Summit focuses on strategic partnerships
Earlier, Olatunji welcomed delegates from Nigeria and other African countries to the summit, stressing that public awareness and cooperation among stakeholders were essential to strengthening data protection across the continent.
The eighth edition of the summit carries the theme, Strengthening Data Protection through Strategic Partnerships.
The Data Protection Royal Ambassador for Nigeria and the Alara of Ilara Kingdom, Oba Olufolarin Ogunsanwo, formally declared the event open.
The Lagos State Governor, Babajide Sanwo-Olu, was represented at the ceremony by his Special Adviser on Technology, Innovation and Broadband, Ganiyu Oseni.
As Nigeria’s digital economy expands, the NDPC faces the challenge of ensuring that innovation does not outpace the safeguards designed to protect consumers.
For businesses, the message is increasingly clear: collecting customer data comes with responsibilities, and partnerships with compliance organisations cannot replace accountability for how that information is handled.
