NIGERIA DATA PROTECTION COMMISSION ADVISORY ON ESCALATING THREATS OF CYBERSECURITY
The Nigeria Data Protection Commission (NDPC) has issued a regulatory advisory to all data controllers and data processors in response to rising threats to data security infrastructure across Nigeria.
Referencing the Commission’s technical assessment, coordinated activities by malicious actors are increasingly targeting financial systems and critical digital infrastructure, raising concerns about the resilience of national data protection frameworks.
The NDPC reiterated the importance of a presidential directive by Bola Ahmed Tinubu, who emphasised the strategic value of data, stating:
“Data is the new oil; its value increases the more it is refined and responsibly shared.”
The directive mandates all Ministries, Departments, and Agencies (MDAs) to rigorously collect and safeguard data in compliance with the Nigeria Data Protection Act 2023.
Urgent Call for Enhanced Data Protection Measures
In light of these developments, the Commission has urged organisations—including public institutions and private sector entities—to strengthen their technical and organisational safeguards to ensure the protection of personal data in accordance with the NDP Act.
NDPC further recommended the following:
- Appointment of qualified and certified Data Protection Officers (DPOs)
- Development and effective implementation of comprehensive privacy policies and information security standards
- Conduct of Data Protection Impact Assessments (DPIAs)
- Deployment of robust identity and access management systems, including Multi-Factor Authentication (MFA)
- Adoption of zero-trust security architecture and network segmentation
- Prompt remediation of system vulnerabilities alongside continuous patch management
- Securing cloud infrastructure, APIs, databases, and access credentials
- Implementation of real-time monitoring, logging, and threat detection systems
- Deployment of encryption protocols, key management systems, and secure credential handling
- Regular Vulnerability Assessment and Penetration Testing (VAPT) for critical systems
- Routine backup procedures, disaster recovery planning, and resilience testing
Regulatory Support and Compliance Enforcement
The NDPC reaffirmed its commitment to supporting organizations in achieving compliance and strengthening data protection standards. It also warned that failure to implement required safeguards under the NDP Act may result in legal and regulatory consequences.
The Commission emphasized its ongoing mission to protect personal data, enhance institutional resilience, and ensure adherence to data protection regulations across all sectors of the economy.
