Project – Assessment of the Legal and Institutional Framework for the Protection of Personal Data in Nigeria: A Case Study of Selected Public and Private Organisations in Lagos State.

CHAPTER ONE

INTRODUCTION

1.1 Background to the Study

The protection of personal data has become an important legal, institutional, and governance issue in contemporary society because individuals increasingly depend on organisations to collect, store, process, share, and manage information relating to their identities and activities. Personal data may include names, residential addresses, telephone numbers, photographs, identification numbers, financial records, employment details, educational records, health information, and online identifiers. Although the collection and use of such information support service delivery, administrative efficiency, business transactions, and technological innovation, inappropriate handling can expose individuals to identity theft, discrimination, financial fraud, unwanted surveillance, and loss of privacy. Consequently, data protection is no longer simply a technical matter for information technology departments; it is also a question of fundamental rights, organisational accountability, and the rule of law. The United Nations General Assembly recognised the importance of privacy in the digital age through its resolutions on the right to privacy, including concerns about the collection, processing, and misuse of personal information by public and private actors (United Nations General Assembly, 2013, 2014).

The international development of data protection law reflects growing recognition that privacy rights require practical safeguards when personal information is processed. Article 12 of the Universal Declaration of Human Rights protects individuals against arbitrary interference with their privacy, family, home, and correspondence, while Article 17 of the International Covenant on Civil and Political Rights provides protection against unlawful or arbitrary interference with privacy. These provisions establish important international human-rights foundations for the protection of personal information. At the regional level, the Economic Community of West African States adopted the Supplementary Act on Personal Data Protection within ECOWAS in 2010, providing a regional framework for the collection, processing, transmission, storage, and use of personal data. These instruments are significant because data frequently moves across organisational and national boundaries, making isolated national safeguards insufficient for addressing every privacy risk. They also provide a basis for evaluating whether Nigeria’s domestic laws and institutions adequately protect individuals while enabling legitimate data processing (United Nations, 1948, 1966; Economic Community of West African States [ECOWAS], 2010).

In Nigeria, the constitutional foundation for privacy protection is found in section 37 of the Constitution of the Federal Republic of Nigeria 1999, which guarantees and protects the privacy of citizens, their homes, correspondence, telephone conversations, and telegraphic communications. However, the contemporary processing of personal information extends beyond traditional correspondence to include digital databases, biometric records, electronic transactions, customer profiles, employee information, and automated systems. Before the enactment of a dedicated national data protection statute, Nigeria relied on a combination of constitutional provisions, sector-specific legislation, regulatory measures, and the Nigeria Data Protection Regulation 2019. Babalola (2022) explains that the country’s earlier data protection framework developed through several legal and regulatory instruments, but that the previous arrangement raised questions concerning regulatory authority, enforcement, and the coherence of the overall legal regime. This history demonstrates the importance of examining not only the existence of legal protections but also their scope, consistency, and practical application to organisations that process personal information (Constitution of the Federal Republic of Nigeria, 1999; Babalola, 2022).

A major development in Nigeria’s data protection system occurred on 12 June 2023, when the Nigeria Data Protection Act 2023 came into force. The Act established the Nigeria Data Protection Commission (NDPC) as the national authority responsible for overseeing the implementation of data protection law and supervising relevant data controllers and data processors. Its objectives include regulating personal data processing, safeguarding the rights and interests of data subjects, promoting fair and accountable processing, providing avenues for redress, and strengthening trust in Nigeria’s digital economy. The Act also provides for principles governing personal data processing, lawful bases for processing, data subject rights, and obligations applicable to organisations handling personal information. This statutory development represents an important transition from a framework substantially dependent on subsidiary regulation to one anchored in a principal Act of the National Assembly. Nevertheless, the enactment of legislation alone does not establish the degree to which organisations understand, implement, or comply with their obligations in everyday operations (Nigeria Data Protection Act, 2023; Nigeria Data Protection Commission [NDPC], 2023).

The institutional framework is equally important because effective data protection requires institutions capable of translating legal provisions into compliance, monitoring, enforcement, guidance, and remedies. The NDPC has a central supervisory role under the Nigeria Data Protection Act 2023, while other public authorities may have responsibilities under sector-specific laws governing such areas as communications, financial services, health, and public administration. Organisations themselves also have internal responsibilities, including determining appropriate purposes for processing personal information, implementing security measures, managing access to records, communicating privacy information, responding to data subject requests, and addressing personal data breaches. Babalola (2022) identifies the institutional and enforcement arrangements as important elements of Nigeria’s data protection model, while the NDPC’s statutory mandate reflects the subsequent establishment of a dedicated commission. Therefore, assessment of the institutional framework must consider the relationship between the national regulator, other relevant public bodies, and the compliance structures maintained by organisations that collect and process personal data (Babalola, 2022; Nigeria Data Protection Act, 2023).

The obligations arising from data protection law are relevant to both public and private organisations, although their activities, purposes, resources, and accountability structures may differ. Public organisations may process personal information for identity management, taxation, education, healthcare, employment, licensing, social services, and other statutory functions. Private organisations may process similar information for banking, telecommunications, insurance, retail, recruitment, digital platforms, and customer relationship management. Both categories may face risks involving unauthorised access, excessive collection, insecure storage, inappropriate disclosure, weak staff awareness, and inadequate procedures for handling complaints. In their analysis of Nigeria’s legal framework, Ifemeje and Okwuosa (2021) observed that the country’s data privacy laws provide a basis for protection but also identified weaknesses requiring legal and institutional attention as digital information practices evolve. Their analysis supports the need to assess organisational implementation alongside formal legal rules, since legal rights are less effective when institutions lack appropriate procedures, technical safeguards, and accountability mechanisms (Ifemeje & Okwuosa, 2021; Nigeria Data Protection Act, 2023).

Lagos State provides a relevant setting for examining the practical operation of personal data protection because it hosts a wide range of public institutions, commercial enterprises, professional service providers, and technology-enabled businesses. Organisations operating in this environment may process large volumes of personal information through physical files, customer databases, electronic payment systems, human resource platforms, websites, and mobile applications. Such activities create opportunities for more efficient service delivery but also increase the importance of lawful processing, information security, transparency, accountability, and appropriate handling of personal data. The NDPC’s establishment and the enactment of the Nigeria Data Protection Act 2023 provide the legal and institutional basis against which organisational practices can be assessed. However, the actual level of awareness, implementation, compliance, and enforcement cannot be established merely by referring to the law. This study therefore examines the legal and institutional framework for personal data protection in Nigeria through selected public and private organisations in Lagos State, focusing on the adequacy of the framework, organisational compliance, institutional effectiveness, and the challenges that may affect the practical protection of personal data (Nigeria Data Protection Act, 2023; NDPC, 2023).

1.2 Statement of the Problem

The increasing collection and processing of personal information by public and private organisations have created important concerns regarding privacy, accountability, and the protection of individuals against misuse of their data. Organisations require personal information to provide services, maintain records, administer employment, process transactions, and fulfil statutory responsibilities. However, when information is collected without adequate transparency, retained longer than necessary, disclosed inappropriately, or protected by inadequate security measures, individuals may experience privacy violations, financial losses, identity theft, and other forms of harm. Although section 37 of the Constitution of the Federal Republic of Nigeria 1999 provides a foundation for privacy protection, the complexity of contemporary data processing requires more specific rules addressing the responsibilities of organisations and the rights of individuals. The central problem is therefore not only whether personal data protection is recognised in Nigerian law, but whether the existing legal arrangements adequately address the risks associated with modern data processing (Constitution of the Federal Republic of Nigeria, 1999; Babalola, 2022).

The enactment of the Nigeria Data Protection Act 2023 marked a significant development by establishing a principal statutory framework and creating the NDPC as the national data protection authority. The Act provides for lawful data processing, data subject rights, organisational responsibilities, regulatory oversight, and mechanisms for addressing violations. Nevertheless, the existence of a comprehensive statute does not automatically guarantee effective protection in practice. Its effectiveness depends on factors such as public awareness, organisational understanding of legal obligations, staff training, technical security measures, internal accountability, regulatory supervision, and the accessibility of remedies for affected individuals. If organisations fail to translate legal requirements into practical procedures, a gap may remain between the protection provided by legislation and the actual experiences of data subjects. Babalola (2022), writing about Nigeria’s earlier data protection model, identified concerns about the coherence of the legal framework and the arrangements for enforcement. The present study therefore considers how the current statutory and institutional framework operates in practice rather than treating enactment of the law as sufficient evidence of effective protection (Babalola, 2022; Nigeria Data Protection Act, 2023).

A further problem concerns the different institutional environments in which personal information is processed. Public organisations may handle data in the discharge of statutory duties, while private organisations may process information for commercial transactions, employment, customer services, and other business purposes. Although both are subject to applicable data protection requirements, they may differ in their organisational structures, resources, technological systems, internal policies, and approaches to accountability. Such differences may influence how effectively legal obligations are implemented. In addition, personal data protection may involve interactions between the NDPC and other regulators responsible for specific sectors. If responsibilities, internal procedures, or compliance arrangements are poorly understood, organisations may experience difficulties in implementing appropriate safeguards. Ifemeje and Okwuosa (2021) identified the need to address weaknesses in Nigeria’s data privacy framework as digital information practices develop. However, an assessment focused on selected public and private organisations in Lagos State is needed to examine their awareness, compliance arrangements, and experiences within the current legal framework (Ifemeje & Okwuosa, 2021; Nigeria Data Protection Act, 2023).

The specific problem addressed by this study is the need to assess the adequacy of Nigeria’s legal and institutional framework for protecting personal data and to determine how effectively selected public and private organisations in Lagos State implement relevant requirements. Without examining organisational practices alongside legislation and regulatory institutions, it is difficult to determine whether legal protections are adequately reflected in data collection, storage, access control, disclosure, security, and complaint-handling procedures. It is also important to identify the institutional, administrative, technical, and awareness-related challenges that may limit effective compliance. The study will therefore examine the relevant legal provisions, assess organisational awareness and compliance practices, evaluate the perceived effectiveness of institutional oversight, and identify challenges affecting personal data protection. In doing so, it seeks to provide evidence that can inform improvements in organisational accountability, regulatory implementation, and the protection of individuals’ privacy rights in Nigeria (Nigeria Data Protection Act, 2023; NDPC, 2023).

1.3 Aim and Objectives of the Study

The aim of this study is to assess the legal and institutional framework for the protection of personal data in Nigeria, using selected public and private organisations in Lagos State as a case study.

The specific objectives are to:

1. Examine the adequacy of the legal framework governing personal data protection in Nigeria.

2. Assess the level of awareness and compliance with personal data protection requirements among selected public and private organisations in Lagos State.

3. Evaluate the effectiveness of the institutional arrangements responsible for the implementation and enforcement of personal data protection in Nigeria.

4. Identify the major legal, institutional, administrative, and technical challenges affecting the protection of personal data in selected public and private organisations in Lagos State.

1.4 Research Questions

The following research questions will guide the study:

1. How adequate is the legal framework governing personal data protection in Nigeria?

2. What is the level of awareness and compliance with personal data protection requirements among selected public and private organisations in Lagos State?

3. How effective are the institutional arrangements responsible for implementing and enforcing personal data protection in Nigeria?

4. What major legal, institutional, administrative, and technical challenges affect personal data protection in selected public and private organisations in Lagos State?

1.5 Research Hypothesis

The following null hypothesis will be tested at the 0.05 level of significance.

H₀: There is no statistically significant relationship between the level of organisational compliance with personal data protection requirements and the perceived effectiveness of the legal and institutional framework for personal data protection among selected public and private organisations in Lagos State.

1.6 Significance of the Study

The study may be beneficial to the following stakeholders.

Government and policymakers: The findings may provide information on the adequacy of existing legal provisions and areas where legislation, policy guidance, or institutional coordination could be strengthened. The findings may also support evidence-informed policy decisions on privacy and digital governance.

Nigeria Data Protection Commission: The study may provide insights into organisational awareness, compliance practices, and implementation challenges. These findings may help inform regulatory education, compliance monitoring, stakeholder engagement, and enforcement priorities.

Public organisations: The study may help public institutions identify weaknesses in their personal data management practices, including record handling, access control, staff awareness, information security, and accountability procedures.

Private organisations: The research may help businesses understand the importance of lawful data processing, appropriate security measures, transparency, and effective internal compliance systems. It may also encourage organisations to integrate data protection into routine operations and risk management.

Individuals and data subjects: The study may improve understanding of personal data protection rights and the responsibilities of organisations that collect and use personal information. Greater awareness may encourage individuals to exercise their rights and seek appropriate remedies where necessary.

Legal practitioners and researchers: The study may contribute to academic and professional discussions on privacy law, institutional accountability, regulatory enforcement, and organisational compliance in Nigeria. It may also provide a foundation for further empirical research in other states and sectors.

1.7 Scope of the Study

The study focuses on the legal and institutional framework for personal data protection in Nigeria, using selected public and private organisations in Lagos State as its case study.

The content scope covers the constitutional and statutory foundations of personal data protection, the Nigeria Data Protection Act 2023, the role of the NDPC, relevant regulatory institutions, organisational awareness, compliance practices, and challenges affecting implementation.

The geographical scope is limited to selected public and private organisations in Lagos State. The participating organisations will be identified according to the study’s sampling criteria and their relevance to personal data processing.

The respondent scope may include relevant management personnel, administrative staff, information technology personnel, legal or compliance officers, and other employees involved in collecting, processing, securing, or managing personal information. The final categories will depend on the selected organisations and the research design.

The study will assess legal provisions and institutional arrangements alongside reported organisational practices. It will not assume that the experiences of the selected organisations necessarily represent every public or private organisation in Nigeria.

1.8 Limitations of the Study

The study may encounter limitations relating to access to organisational records, willingness of respondents to disclose compliance challenges, and the sensitivity of information about data security incidents. Some organisations may be reluctant to provide internal policies or details of previous breaches because of confidentiality concerns or reputational risks.

Another possible limitation is that respondents’ answers may reflect their personal understanding of data protection requirements rather than the actual compliance status of their organisations. Where the study relies on questionnaires or interviews, the findings may also be influenced by incomplete responses or differences in interpretation.

The geographical restriction to selected organisations in Lagos State may limit the extent to which the findings can be generalised to other states or sectors. These limitations may be addressed by explaining the study’s purpose, protecting respondents’ confidentiality, using clearly worded research instruments, comparing responses across relevant organisational categories, and reviewing available policies or documentary evidence where access is authorised.

1.9 Operational Definition of Terms

Personal data: Information relating to an identified or identifiable individual, as defined under the Nigeria Data Protection Act 2023.

Data protection: The legal, organisational, administrative, and technical measures used to ensure that personal information is processed lawfully and responsibly and that individuals’ rights are respected.

Legal framework: The constitutional provisions, statutes, regulations, and other applicable legal instruments governing the collection, processing, storage, disclosure, and protection of personal data in Nigeria.

Institutional framework: The regulatory bodies, public authorities, organisational structures, and administrative arrangements responsible for implementing, supervising, and enforcing personal data protection requirements.

Nigeria Data Protection Commission (NDPC): The statutory body established under the Nigeria Data Protection Act 2023 to oversee the implementation of the Act and perform the functions assigned to it by law.

Data subject: An individual to whom personal data relates.

Data controller: A person or organisation that determines the purposes and means of processing personal data, in accordance with the applicable law.

Data processor: A person or organisation that processes personal data on behalf of a data controller, as defined by the applicable legal framework.

Organisational compliance: The extent to which an organisation’s policies, procedures, and actual practices conform to applicable personal data protection requirements.

Public organisation: A government institution or public-sector body included in the study.

Private organisation: A non-governmental business or institution included in the study that processes personal data in carrying out its activities.

Effectiveness: The extent to which the legal and institutional framework achieves its intended objectives, as assessed through relevant evidence of organisational compliance, regulatory implementation, accountability, and protection of data subjects’ rights.

Project – Assessment of the Legal and Institutional Framework for the Protection of Personal Data in Nigeria: A Case Study of Selected Public and Private Organisations in Lagos State.