Govt orders ministries to tighten data protection rules

The Federal Government has directed Ministries, Departments and Agencies to strengthen data protection practices as part of efforts to improve public trust in digital governance and ensure responsible handling of citizens’ personal information.

The directive, contained in Circular No. 59805/S.I/74 dated July 27, 2026, requires all federal institutions to comply with the Nigeria Data Protection Act (NDP Act) 2023, regulations and guidelines issued by the Nigeria Data Protection Commission.

The circular was signed by Secretary to the Government of the Federation, Senator George Akume, following a directive from President Bola Ahmed Tinubu urging government agencies to collect, manage and protect data responsibly.

“Data is the new oil: its value increases the more it is refined and responsibly shared,” President Tinubu said in the directive referenced in the circular. “I therefore direct all Ministries, Extra-Ministerial Departments and Agencies to capture information rigorously and safeguard it under the Nigeria Data Protection Act, 2023.”

 Under the new compliance requirements, MDAs are expected to appoint qualified Data Protection Officers responsible for overseeing data protection activities, advising management on lawful processing of personal information and serving as points of contact with the NDPC.

The agencies are also required to submit the details of their designated DPOs to the commission, engage licensed Data Protection Compliance Organisations where necessary, allocate budgets for compliance activities and file mandatory data protection audit returns within regulatory timelines.

The government placed direct responsibility on senior officials, stating that Permanent Secretaries, Accounting Officers and Chief Executive Officers of MDAs would be personally responsible for ensuring institutional compliance with the directive and provisions of the NDP Act.

 The move comes as Nigeria accelerates its digital transformation agenda, with government services increasingly moving online and public institutions collecting larger volumes of citizen data through digital platforms.

The growth of digital identity systems, online government services, financial technology platforms and data-driven public programmes has increased concerns around cybersecurity, privacy protection and the responsible use of personal information.

Nigeria enacted the Data Protection Act in 2023 to establish a stronger legal framework for protecting personal data and regulating how organisations collect, process and store information belonging to individuals.

The law replaced the Nigeria Data Protection Regulation introduced in 2019 and expanded the mandate of the NDPC as the country’s data protection regulator.

Commenting on the directive, National Commissioner and Chief Executive Officer of the Nigeria Data Protection Commission, Dr. Vincent Olatunji, said data accountability would be critical to achieving the government’s development priorities.

Dr. Olatunji praised the administration’s commitment to protecting the privacy and fundamental freedoms of data subjects, adding that the commission remained focused on supporting public institutions to meet compliance requirements.

He said the NDPC had established a regulatory clinic to provide technical support to MDAs as they implement the new requirements.

“Data accountability is pivotal to achieving the eight Presidential Priorities,” Dr. Olatunji said, adding that the commission would continue to provide guidance to institutions navigating compliance obligations.

The government said the latest directive forms part of broader regulatory efforts to strengthen Nigeria’s position in the digital economy and prepare public institutions for the demands of the Fourth Industrial Revolution.