Data protection: NDPC vows to start imposing heavy fines in 2025 

The National Commissioner of the Commission, Dr. Vincent Olatunji, disclosed this in his outlook for the year.

According to him, NDPC up until now has not fined any company but that will start this year as it begins massive enforcement of the Nigeria Data Protection Act (NDPA).

“For data controllers and processors, there is going to be massive enforcement in 2025. We have never issued any fines, but going forward you will hear us issuing heavy penalties,” Olatunji stated.

While noting that the Commission would begin the second phase of its 2023-2027 Roadmap this year, Olatunji said the NDPC would also be creating jobs through data protection experts it trained last year.

“There are a lot of data controllers and processors that are looking for people to work with them.  

“Now those that we have trained in 2024, those we have certified, we are going to do more this year to actually launch them to the job market where they can really work with data controllers and processors,” the Commissioner said.

Ahead of this year’s enforcement plan, the NDPC Commissioner at a forum in Lagos in 2023 announced the timeline for the registration of all data controllers and processors, which include all organizations that deal with people’s data such as banks, telecom operators, insurance companies, schools, among others.

“What we have in the law is that all data controllers and processors and there are over 500,000 in Nigeria, that they should register with the data protection authority.  

“What the law says is that we should give them six months to acquaint themselves with the provisions of the law.  

“And that is why carrying out awareness across the country, we are going to do another one in Abuja very soon. The data controllers need to register with us because you can’t count them if you don’t know them. So, we need to have a number, and then those that are captured will be monitored to see how they are managing the data in their care and we can regulate them appropriately.  

“So, between now and December 31, they are to register with the commission. And from the first of January to 31st of March next year (2024), they are to submit their annual audit report, telling us what they have done in the area of putting in place measures to safeguard our data with them.” 

President Bola Tinubu signed the country’s Data Protection Bill into law on June 12, 2023.