ADVANCING DATA PROTECTION IN NIGERIA: THE NEED FOR COMPREHENSIVE LEGISLATION

The increasing reliance on digital technologies has raised significant concerns about data privacy, security, and
regulatory compliance. As businesses, financial institutions, and government agencies collect and process vast
amounts of personal data, the risks associated with unauthorized access, cyber threats, and data breaches have
escalated. Globally, nations have implemented comprehensive data protection laws, such as the European Union’s
General Data Protection Regulation (GDPR), to safeguard personal information, enforce accountability, and
strengthen cybersecurity. However, Nigeria lacks a dedicated and comprehensive data protection law, leading to
challenges in enforcement, compliance, and public trust. Data protection in Nigeria is governed by a fragmented
legal framework, including the Cybercrime (Prohibition, Prevention, etc.) Act of 2015, the National Information
Technology Development Agency (NITDA) Guidelines, and sector-specific regulations. These measures,
however, were insufficient in addressing the growing complexities of digital data governance, cross-border data
transfers, and consumer rights protection. The absence of clear legal provisions, regulatory overlap, and
inadequate enforcement mechanisms created legal uncertainties for businesses and individuals, limiting Nigeria’s
ability to align with global data protection standards. This paper examines the state of data protection in Nigeria
analysing the shortcomings of existing policies and comparing them with international best practices. It highlights
the need for a comprehensive data protection law that defines the rights of data subjects, strengthens enforcement
mechanisms, and establishes institutional oversight. Implementing a robust legal framework would enhance
cybersecurity resilience, support Nigeria’s digital economy, and foster trust in digital transactions, ultimately
positioning Nigeria for greater global competitiveness in the data-driven economy.