Nigeria Data Protection Act: FG Orders MDAs to Name DPOs

In Short

Nigeria Data Protection Act compliance is getting stricter across federal government agencies. The Federal Government has told all MDAs to appoint Data Protection Officers, register them with the Nigeria Data Protection Commission, and meet audit and budgeting requirements.

What Happened

The Federal Government issued a compliance circular directing all Ministries, Departments and Agencies to appoint Data Protection Officers (DPOs). A DPO is the staff member responsible for making sure an organisation follows privacy rules when it collects and uses personal data like names, phone numbers, biometrics, and medical records.

The circular, signed by the Secretary to the Government of the Federation, also requires MDAs to register their DPOs with the Nigeria Data Protection Commission (NDPC). MDAs must comply with the Nigeria Data Protection Act (NDPA) 2023, plus NDPC regulations, guidelines, and directives covering how personal data is processed.

Where needed, MDAs are expected to work with licensed Data Protection Compliance Organisations, which are approved third parties that help organisations meet privacy obligations and run compliance audits. The circular also tells agencies to submit mandatory Data Protection Compliance Audit Returns to the NDPC within legal timelines.

The directive adds an enforcement angle. Permanent Secretaries, Accounting Officers, and Chief Executive Officers of MDAs will be personally responsible for compliance.

Why It Matters

For citizens, the focus is trust. Government agencies hold large volumes of sensitive data, and poor controls can lead to leaks, fraud, and identity abuse.

For vendors selling software and cloud services to government, privacy requirements are likely to show up more often in procurement. That includes proving security controls, staff training, audit readiness, and clear data handling processes.

For teams inside MDAs, this is also a resourcing issue. The circular explicitly calls for budget provisions for training, awareness programmes, technical safeguards, and periodic audits. Many agencies will need to formalise governance, update policies, and document how systems store and share personal information.

Companies offering compliance tooling, policy management, and e-signature or record-keeping workflows, such as PaperTrail, may see increased demand as agencies work to meet NDPC expectations.