NDPC, Health Ministry Partner to Strengthen Data Protection in Nigeria’s Healthcare Sector

The partnership underscores the critical importance of safeguarding sensitive patient information and ensuring compliance with the Nigeria Data Protection Act, 2023. It aimed to address challenges in evolving landscape of data protection in Nigeria’s health sector and to align with collaborative strategies for effective implementation of relevant priorities areas of President Bola Ahmed Tinubu’s administration.

These issues were brought to the fore during a working visit by the National Commissioner/CEO of NDPC, Dr Vincent Olatunji, to the Coordinating Minister of Health and Social Welfare, Professor Muhammad Ali Pate, in Abuja.

Dr Olatunji provided an overview of the Commission’s mandate and underscored the urgency of data protection in healthcare. He stressed the need for healthcare workers and policymakers to establish systems that ensure the confidentiality, integrity, and security of personal health data.

He warned that data breaches could lead to discrimination, misdiagnosis, and even loss of life in severe cases.
In his words, “This sector is generally sensitive, and the kind of information collected has to do with medical records which could be used to discriminate against anyone seeking to have a good healthcare.”

He also drew attention to the global shift towards digital systems, emphasising that every online activity creates a “digital blueprint” of personal information. He stressed the importance of establishing a secure data processing environment across all healthcare institutions, including hospitals, Health Management Organisations (HMOs), and entities handling patient data.

Dr Olatunji explained the legal foundation of data protection in Nigeria, tracing its evolution from the 2019 Nigeria Data Protection Regulation (NDPR) to the formation of the Nigeria Data Protection Bureau and, eventually, the enactment of the NDP Act, 2023. This progression, he noted, earned Nigeria admission into the Global Privacy Assembly—an international recognition of the country’s commitment to data privacy.

Speaking on capacity building in the data protection and privacy ecosystem, Dr Olatunji said, “When we began, less than 5,000 professionals were qualified to work in the ecosystem. Today, we have over 10,000 trained data protection professionals across the country.”

He further noted that the sector has grown into a 10 billion Naira economy within just two years, and with significant potential for more job creation. He said, “Nigeria has over 500,000 data controllers. We currently have just 10,000 certified Data Protection Officers (DPOs). This gap presents an opportunity to create about half a million jobs for Nigerians in line with the Mr President’s goal of creating 2 million jobs in the digital economy sector.

In response, Professor Pate acknowledged the sensitivity of health data and appreciated the enlightening insights shared by Dr Olatunji. According to him, “The health sector is a unique sector. We collect extensive data — from personal health details to demographic statistics — across all our facilities.”

The Minister expressed satisfaction with the Commission’s progress and affirmed the Ministry’s commitment to compliance across its 107 associated entities. He also raised questions about the NDP Act’s extraterritorial scope, the regulation of harmful external data, and protections for sensitive research and biodiversity data.

In response, Dr Olatunji clarified that the NDP Act, 2023 applies to any data controller or processor handling the personal data of Nigerians, whether within or outside the country. he said,

“If you reside in Nigeria and process Nigerian data, you are within scope. Even if you are outside Nigeria, once you process the data of Nigerians, you are within scope — and that’s why we are currently investigating global platforms like Truecaller and TikTok.”
He outlined the framework for cross-border data transfers, which requires an “adequacy decision” to ensure that foreign jurisdictions uphold data subject rights and maintain comparable legal standards.

Dr Olatunji assured Professor Pate that the law also provides safeguards for scientific research data, and reaffirmed the NDPC’s preference for encouraging compliance through sensitization rather than enforcement alone.

For swift education on data protection and privacy across all sectors, the NDPC collaborates with licensed Data Protection Compliance Organisations (DPCOs) to guide institutions toward full compliance. He offered free training sessions for healthcare personnel to build basic data privacy knowledge. He said, “We’re happy to offer free induction training for your staff — to build foundational understanding of data protection principles.”

Professor Pate welcomed the training initiative and invited the NDPC to make a presentation at the next meeting of the Committee of Chief Medical Directors to promote data protection awareness among healthcare leaders.
This engagement signifies a pivotal milestone in strengthening Nigeria’s healthcare data protection framework, reinforcing public trust and safeguarding the sensitive health information of all citizens. A team was set up to implement the partnership between the two institutions.