Nigeria’s data privacy breaches surge amid regulatory pressure

SAMI TUNJI examines the surge in data privacy breaches in Nigeria, highlighting concerns over increasing cyber threats, non-compliance with the Nigeria Data Protection Act, and inadequate enforcement by regulators

Nigeria has witnessed a sharp increase in cases of data privacy breaches despite heightened regulatory oversight by the Nigeria Data Protection Commission.

The recently released 2024 NDPC Annual Report paints a troubling picture of escalating investigations into unauthorised data access, identity theft, behavioural profiling, and non-transparent mobile application practices. These breaches come at a time when data protection law is being reinforced, highlighting the tension between businesses leveraging personal data for commercial gains and government efforts to enforce compliance with the Nigeria Data Protection Act of 2023.

Despite notable regulatory progress, the increasing sophistication of cyber threats and the reluctance of some organisations to comply with data protection measures signal that Nigeria’s digital privacy landscape remains fragile. While the NDPC has implemented stringent measures to hold businesses accountable, the volume of reported breaches suggests that gaps persist in enforcing privacy regulations, putting millions of Nigerians at risk.

Rising cases of data breaches

Nigeria ranks 4th in the list of African countries with the most data breaches.

According to data from the Netherlands-based virtual private network firm Surf Shark, Nigeria emerged as the 4th ranked African country with the most data breaches in 2024. With 19,326,746 breached accounts and a rate of nine per 100 people, Nigeria faces significant challenges in data security.

Data breaches pose financial risks to businesses, particularly in sectors like finance and e-commerce, and threaten national security by exposing sensitive government databases. As digital dependence grows across industries in Nigeria, safeguarding personal and institutional data remains a critical concern to protect against identity theft, financial fraud, and other forms of exploitation.

According to the NDPC Annual Report, investigations into privacy violations surged to 213 cases in 2024, a significant rise from 177 cases in 2023 and 117 in 2022. This increase highlights the mounting challenge of securing personal data in Nigeria’s evolving digital economy. The regulatory agency has identified several areas of concern, including unauthorised access to personal data, identity theft, behavioural profiling, loss of personal data, and the widespread use of artificial intelligence in decision-making without human intervention.

Unauthorised access to personal data remains one of the most prevalent issues, with many organisations failing to implement robust security protocols. The ease with which sensitive information can be accessed by unauthorised personnel or malicious actors raises significant privacy concerns.

Additionally, identity theft has become more sophisticated, with cybercriminals using stolen personal data to defraud individuals and financial institutions. Cases of behavioural profiling have also drawn regulatory scrutiny, particularly in the digital advertising sector, where user activities are tracked without explicit consent.

The report further highlights the severe consequences of poor data management, particularly when personal data is lost. Several incidents have been documented where individuals have faced serious financial and legal difficulties due to losing crucial personal records. Automated decision-making without human oversight has also raised concerns, especially in credit scoring and insurance underwriting, where individuals may be denied services based on opaque algorithmic assessments.

Regulatory efforts and growing pressure on businesses

In response to the surge in data breaches, the NDPC has intensified regulatory actions to ensure compliance with data protection laws. One of the major initiatives introduced in 2024 is the issuance of the General Application and Implementation Directive, which provides a comprehensive framework covering 42 areas of data protection, including audit filing requirements and compliance principles. The NDPC has also made registering Data Controllers and Processors of Major Importance mandatory, with over 36,052 organisations registered. This measure aims to enhance oversight and accountability for businesses handling large volumes of personal data.

Also, the Commission has stepped up enforcement actions, launching targeted investigations into organisations that process personal data without proper user consent. One area of concern is the increasing volume of cross-border data transfers, where Nigerian citizens’ personal data is moved to foreign entities without adequate safeguards. To address this, the NDPC has strengthened international collaborations by signing agreements with data protection authorities in Canada and United Arab Emirates. These partnerships ensure Nigerian data is protected under global standards, even when processed outside the country.

Despite these efforts, compliance remains challenging, as many organisations continue to exploit legal loopholes or neglect data protection requirements. The NDPC has adopted a restorative justice approach, encouraging businesses to implement corrective measures rather than imposing immediate penalties. However, with data breaches becoming more frequent, there is growing pressure on the Commission to impose stricter sanctions on non-compliant entities.

The cost of data breaches

Nigeria’s Consumer Awareness and Financial Enlightenment Initiative had projected a $6 tn loss by 2030 to cybercrime within and outside Nigeria. These crimes are committed mostly through phishing and identity theft. This figure highlights the urgent need for businesses to prioritise data security.

Beyond financial losses, data breaches have broader implications for businesses and individuals. One of the most significant consequences is the erosion of public trust. As awareness of data privacy rights grows, consumers become increasingly cautious about sharing personal information with organisations with poor data governance practices. While currently moderate, regulatory penalties are expected to become stricter as the NDPC moves towards enhanced enforcement. Reputational damage is another major risk, as high-profile breaches can lead to customer attrition and loss of investor confidence.

Challenges in enforcement and compliance

A study has ranked Nigeria sixth among the 10 countries least prepared for data security threats. The study by PSONO, a self-hosted and open-source password manager, evaluated 54 countries to identify the most and least prepared for data security threats in 2024. According to the report, the 10 least prepared countries in the ranking order include Mexico, Egypt, New Zealand, Peru, Argentina, Nigeria, Kuwait, Vietnam, Colombia, and Chile.

Despite the progress made by regulators, several challenges continue to hinder effective data privacy enforcement in Nigeria. A major issue is the low public awareness about data protection rights. Many Nigerians remain unaware of how their personal data is used, making them easy targets for data exploitation.

Additionally, compliance measures among businesses remain inadequate. While the NDPC has certified 2,888 Data Protection Officers, this number is still insufficient, given the scale of personal data processing in the country.

Slow adoption of international best practices is another issue. While Nigeria has aligned its regulations with global frameworks such as the EU’s General Data Protection Regulation, implementation has been inconsistent. Furthermore, many organisations do not report data breaches due to fears of reputational damage. This weak reporting culture makes it difficult for regulators to track and address violations effectively.

At the 2025 Global Privacy Day event in Abuja, the National Commissioner and CEO of the Nigeria Data Protection Commission, Dr Vincent Olatunji, reiterated the Commission’s commitment to enhancing data privacy across public and private entities in the country. In compliance with the Fostering Data Protection Privacy in Nigeria framework, the Commission plans to enforce stricter data protection measures to safeguard sensitive information and promote regulatory compliance nationwide.

Olatunji stated that to enforce their laws against anyone who violates Nigeria’s data regulations, they have formed memorandums of understanding with the Data Protection Authorities of other nations. He also noted that back home here in the country, they are still signing MoUs with regulators to ensure full compliance.

Experts call for adequate public awareness

Experts blame public ignorance about data rights as Nigeria witnesses a sharp rise in data privacy breaches, driven by increasing digitisation and slow enforcement of the Nigeria Data Protection Act.

A former data protection officer at the NDPC, who is now a researcher in data privacy and cybersecurity at East Tennessee State University, Olugbile Hassan, attributes this trend to poor compliance, inadequate security controls, and a lack of awareness among businesses and individuals.

According to him, many organisations fail to implement mandatory data protection measures, leaving personal data vulnerable.

He noted that some companies do not appoint data protection officers or conduct regular audits, while others apply weak security frameworks.

Meanwhile, he said public knowledge about data privacy remains low, limiting accountability for violations.

Hassam said, “The lack of awareness also plays a crucial role. A significant number of businesses and individuals are not adequately informed about data protection regulations and their implications. Without proper knowledge, organisations may unknowingly mishandle personal data, leading to breaches. Similarly, data subjects may not fully understand their rights, making it difficult for them to hold organisations accountable.”

To address these challenges, he noted, “Addressing the surge in data privacy breaches requires a collective effort from all stakeholders. Organisations must recognise that data protection is everyone’s business.

“While the NDPC is actively working to ensure compliance, organisations must take ownership of their responsibilities. These include allocating adequate resources to their data protection compliance programmes, implementing robust technical and organisational measures, and ensuring full compliance with the Nigeria Data Protection Act.”

Hassan also argues that education is key to reducing data breaches. He urges the NDPC to focus on public awareness and proactive governance, ensuring individuals understand their privacy rights.

He added, “Data subjects also have a significant role to play in protecting their personal information. Individuals must educate themselves about their data privacy rights and take proactive steps to safeguard their information.

“These include exercising their rights—such as lodging complaints with the NDPC when their data is mishandled—and being cautious about sharing personal information, especially online, to minimise the risk of unauthorised access and misuse.”

Also speaking with The PUNCH, the Chief Executive Officer of e86 Limited, Olugbenga Odeyemi, criticised Nigeria’s approach to data privacy regulation, arguing that the NDPC prioritises revenue generation over public education.

He expressed concerns over the mandatory registration fees and training costs imposed on organisations rather than ensuring widespread awareness of data privacy laws. Odeyemi described the NDPC’s strategy as counterproductive, stating that effective regulation should focus on education, not fundraising.

He compared Nigeria’s approach to the General Data Protection Regulation in Europe, where businesses can access clear compliance guidelines freely without compulsory registration or payment. According to him, Nigeria should follow a similar model to encourage adherence rather than penalising organisations upfront. He further argued that a lack of mass public awareness contributes to the growing number of data privacy breaches.

Instead of targeting corporate bodies for revenue, he suggested that the NDPC collaborate with the National Orientation Agency, Ministry of Education, and universities to integrate data privacy education into school curricula.

Odeyemi linked rising data privacy violations to the NDPC’s failure to educate Nigerians on their rights properly.

He noted that while enforcement through fines is increasing, many Nigerians remain unaware of their rights, leading to legal actions against banks, telecom firms, and loan apps.

He called for a shift towards nationwide awareness campaigns and publicly accessible guidelines, urging the NDPC to reconsider its approach.

“Success should be measured by how many Nigerians understand data privacy, not by how much money the regulator collects,” he concluded.

As Nigeria continues to expand its digital economy, there is an urgent need to strengthen data protection frameworks.  There is also a need for enhanced consumer education initiatives. Increasing public awareness campaigns will empower Nigerians to understand their data rights and hold organisations accountable. Businesses must also prioritise investments in cybersecurity infrastructure. Implementing stronger encryption, multi-factor authentication, and regular security audits can help mitigate the risk of breaches. Improved international collaboration is another crucial aspect, as global partnerships can enhance Nigeria’s enforcement capabilities and ensure compliance with international data protection standards.

As regulatory enforcement intensifies, the challenge of balancing data privacy, economic growth, and technological innovation will remain a focal point. While the NDPC has made significant strides, achieving a secure and privacy-conscious digital ecosystem will require continued collaboration between regulators, businesses, and the public.