Nigeria’s knowledge privateness breaches surge amid regulatory strain

SAMI TUNJI examines the surge in knowledge privateness breaches in Nigeria, highlighting considerations over rising cyber threats, non-compliance with the Nigeria Information Safety Act, and insufficient enforcement by regulators

Nigeria has witnessed a pointy enhance in circumstances of knowledge privateness breaches regardless of heightened regulatory oversight by the Nigeria Information Safety Fee.

The lately launched 2024 NDPC Annual Report paints a troubling image of escalating investigations into unauthorised knowledge entry, id theft, behavioural profiling, and non-transparent cellular software practices. These breaches come at a time when knowledge safety legislation is being bolstered, highlighting the strain between companies leveraging private knowledge for business positive aspects and authorities efforts to implement compliance with the Nigeria Information Safety Act of 2023.

Regardless of notable regulatory progress, the rising sophistication of cyber threats and the reluctance of some organisations to adjust to knowledge safety measures sign that Nigeria’s digital privateness panorama stays fragile. Whereas the NDPC has carried out stringent measures to carry companies accountable, the quantity of reported breaches means that gaps persist in imposing privateness rules, placing thousands and thousands of Nigerians in danger.

Rising circumstances of knowledge breaches

Nigeria ranks 4th within the record of African international locations with probably the most knowledge breaches.

In response to knowledge from the Netherlands-based digital personal community agency Surf Shark, Nigeria emerged because the 4th ranked African nation with probably the most knowledge breaches in 2024. With 19,326,746 breached accounts and a charge of 9 per 100 folks, Nigeria faces important challenges in knowledge safety.

Information breaches pose monetary dangers to companies, significantly in sectors like finance and e-commerce, and threaten nationwide safety by exposing delicate authorities databases. As digital dependence grows throughout industries in Nigeria, safeguarding private and institutional knowledge stays a vital concern to guard towards id theft, monetary fraud, and different types of exploitation.

In response to the NDPC Annual Report, investigations into privateness violations surged to 213 circumstances in 2024, a big rise from 177 circumstances in 2023 and 117 in 2022. This enhance highlights the mounting problem of securing private knowledge in Nigeria’s evolving digital financial system. The regulatory company has recognized a number of areas of concern, together with unauthorised entry to non-public knowledge, id theft, behavioural profiling, lack of private knowledge, and the widespread use of synthetic intelligence in decision-making with out human intervention.

Unauthorised entry to non-public knowledge stays some of the prevalent points, with many organisations failing to implement strong safety protocols. The benefit with which delicate info may be accessed by unauthorised personnel or malicious actors raises important privateness considerations.

Moreover, id theft has grow to be extra subtle, with cybercriminals utilizing stolen private knowledge to defraud people and monetary establishments. Instances of behavioural profiling have additionally drawn regulatory scrutiny, significantly within the digital promoting sector, the place consumer actions are tracked with out specific consent.

The report additional highlights the extreme penalties of poor knowledge administration, significantly when private knowledge is misplaced. A number of incidents have been documented the place people have confronted severe monetary and authorized difficulties resulting from dropping essential private information. Automated decision-making with out human oversight has additionally raised considerations, particularly in credit score scoring and insurance coverage underwriting, the place people could also be denied providers based mostly on opaque algorithmic assessments.

Regulatory efforts and rising strain on companies

In response to the surge in knowledge breaches, the NDPC has intensified regulatory actions to make sure compliance with knowledge safety legal guidelines. One of many main initiatives launched in 2024 is the issuance of the Normal Utility and Implementation Directive, which offers a complete framework masking 42 areas of knowledge safety, together with audit submitting necessities and compliance ideas. The NDPC has additionally made registering Information Controllers and Processors of Main Significance obligatory, with over 36,052 organisations registered. This measure goals to boost oversight and accountability for companies dealing with giant volumes of non-public knowledge.

Additionally, the Fee has stepped up enforcement actions, launching focused investigations into organisations that course of private knowledge with out correct consumer consent. One space of concern is the rising quantity of cross-border knowledge transfers, the place Nigerian residents’ private knowledge is moved to overseas entities with out ample safeguards. To deal with this, the NDPC has strengthened worldwide collaborations by signing agreements with knowledge safety authorities in Canada and United Arab Emirates. These partnerships guarantee Nigerian knowledge is protected underneath international requirements, even when processed outdoors the nation.

Regardless of these efforts, compliance stays difficult, as many organisations proceed to use authorized loopholes or neglect knowledge safety necessities. The NDPC has adopted a restorative justice method, encouraging companies to implement corrective measures relatively than imposing fast penalties. Nevertheless, with knowledge breaches turning into extra frequent, there’s rising strain on the Fee to impose stricter sanctions on non-compliant entities.

The price of knowledge breaches

Nigeria’s Shopper Consciousness and Monetary Enlightenment Initiative had projected a $6 tn loss by 2030 to cybercrime inside and outdoors Nigeria. These crimes are dedicated largely by way of phishing and id theft. This determine highlights the pressing want for companies to prioritise knowledge safety.

Past monetary losses, knowledge breaches have broader implications for companies and people. Some of the important penalties is the erosion of public belief. As consciousness of knowledge privateness rights grows, customers grow to be more and more cautious about sharing private info with organisations with poor knowledge governance practices. Whereas at the moment average, regulatory penalties are anticipated to grow to be stricter because the NDPC strikes in direction of enhanced enforcement. Reputational injury is one other main danger, as high-profile breaches can result in buyer attrition and lack of investor confidence.

Challenges in enforcement and compliance

A examine has ranked Nigeria sixth among the many 10 international locations least ready for knowledge safety threats. The examine by PSONO, a self-hosted and open-source password supervisor, evaluated 54 international locations to determine probably the most and least ready for knowledge safety threats in 2024. In response to the report, the ten least ready international locations within the rating order embrace Mexico, Egypt, New Zealand, Peru, Argentina, Nigeria, Kuwait, Vietnam, Colombia, and Chile.

Regardless of the progress made by regulators, a number of challenges proceed to hinder efficient knowledge privateness enforcement in Nigeria. A serious situation is the low public consciousness about knowledge safety rights. Many Nigerians stay unaware of how their private knowledge is used, making them straightforward targets for knowledge exploitation.

Moreover, compliance measures amongst companies stay insufficient. Whereas the NDPC has licensed 2,888 Information Safety Officers, this quantity remains to be inadequate, given the size of non-public knowledge processing within the nation.

Gradual adoption of worldwide finest practices is one other situation. Whereas Nigeria has aligned its rules with international frameworks such because the EU’s Normal Information Safety Regulation, implementation has been inconsistent. Moreover, many organisations don’t report knowledge breaches resulting from fears of reputational injury. This weak reporting tradition makes it troublesome for regulators to trace and tackle violations successfully.

On the 2025 World Privateness Day occasion in Abuja, the Nationwide Commissioner and CEO of the Nigeria Information Safety Fee, Dr Vincent Olatunji, reiterated the Fee’s dedication to enhancing knowledge privateness throughout private and non-private entities within the nation. In compliance with the Fostering Information Safety Privateness in Nigeria framework, the Fee plans to implement stricter knowledge safety measures to safeguard delicate info and promote regulatory compliance nationwide.

Olatunji said that to implement their legal guidelines towards anybody who violates Nigeria’s knowledge rules, they’ve shaped memorandums of understanding with the Information Safety Authorities of different nations. He additionally famous that again dwelling right here within the nation, they’re nonetheless signing MoUs with regulators to make sure full compliance.

Consultants name for ample public consciousness

Consultants blame public ignorance about knowledge rights as Nigeria witnesses a pointy rise in knowledge privateness breaches, pushed by rising digitisation and sluggish enforcement of the Nigeria Information Safety Act.

A former knowledge safety officer on the NDPC, who’s now a researcher in knowledge privateness and cybersecurity at East Tennessee State College, Olugbile Hassan, attributes this development to poor compliance, insufficient safety controls, and a lack of know-how amongst companies and people.

In response to him, many organisations fail to implement obligatory knowledge safety measures, leaving private knowledge weak.

He famous that some corporations don’t appoint knowledge safety officers or conduct common audits, whereas others apply weak safety frameworks.

In the meantime, he stated public information about knowledge privateness stays low, limiting accountability for violations.

Hassam stated, “The lack of know-how additionally performs an important function. A major variety of companies and people usually are not adequately knowledgeable about knowledge safety rules and their implications. With out correct information, organisations might unknowingly mishandle private knowledge, resulting in breaches. Equally, knowledge topics might not absolutely perceive their rights, making it troublesome for them to carry organisations accountable.”

To deal with these challenges, he famous, “Addressing the surge in knowledge privateness breaches requires a collective effort from all stakeholders. Organisations should recognise that knowledge safety is everybody’s enterprise.

“Whereas the NDPC is actively working to make sure compliance, organisations should take possession of their obligations. These embrace allocating ample assets to their knowledge safety compliance programmes, implementing strong technical and organisational measures, and guaranteeing full compliance with the Nigeria Information Safety Act.”

Hassan additionally argues that schooling is essential to decreasing knowledge breaches. He urges the NDPC to deal with public consciousness and proactive governance, guaranteeing people perceive their privateness rights.

He added, “Information topics even have a big function to play in defending their private info. People should educate themselves about their knowledge privateness rights and take proactive steps to safeguard their info.

“These embrace exercising their rights—comparable to lodging complaints with the NDPC when their knowledge is mishandled—and being cautious about sharing private info, particularly on-line, to minimise the chance of unauthorised entry and misuse.”

Additionally talking with The PidomNigeria, the Chief Govt Officer of e86 Restricted, Olugbenga Odeyemi, criticised Nigeria’s method to knowledge privateness regulation, arguing that the NDPC prioritises income technology over public schooling.

He expressed considerations over the obligatory registration charges and coaching prices imposed on organisations relatively than guaranteeing widespread consciousness of knowledge privateness legal guidelines. Odeyemi described the NDPC’s technique as counterproductive, stating that efficient regulation ought to deal with schooling, not fundraising.

He in contrast Nigeria’s method to the Normal Information Safety Regulation in Europe, the place companies can entry clear compliance pointers freely with out obligatory registration or cost. In response to him, Nigeria ought to comply with an analogous mannequin to encourage adherence relatively than penalising organisations upfront. He additional argued {that a} lack of mass public consciousness contributes to the rising variety of knowledge privateness breaches.

As an alternative of focusing on company our bodies for income, he steered that the NDPC collaborate with the Nationwide Orientation Company, Ministry of Training, and universities to combine knowledge privateness schooling into faculty curricula.

Odeyemi linked rising knowledge privateness violations to the NDPC’s failure to teach Nigerians on their rights correctly.

He famous that whereas enforcement by way of fines is rising, many Nigerians stay unaware of their rights, resulting in authorized actions towards banks, telecom corporations, and mortgage apps.

He known as for a shift in direction of nationwide consciousness campaigns and publicly accessible pointers, urging the NDPC to rethink its method.

“Success needs to be measured by what number of Nigerians perceive knowledge privateness, not by how a lot cash the regulator collects,” he concluded.

As Nigeria continues to develop its digital financial system, there’s an pressing have to strengthen knowledge safety frameworks.  There’s additionally a necessity for enhanced shopper schooling initiatives. Growing public consciousness campaigns will empower Nigerians to know their knowledge rights and maintain organisations accountable. Companies should additionally prioritise investments in cybersecurity infrastructure. Implementing stronger encryption, multi-factor authentication, and common safety audits may help mitigate the chance of breaches. Improved worldwide collaboration is one other essential facet, as international partnerships can improve Nigeria’s enforcement capabilities and guarantee compliance with worldwide knowledge safety requirements.

As regulatory enforcement intensifies, the problem of balancing knowledge privateness, financial development, and technological innovation will stay a focus. Whereas the NDPC has made important strides, reaching a safe and privacy-conscious digital ecosystem would require continued collaboration between regulators, companies, and the general public.