Written by Joshua Orom
Nigeria’s New Data Protection Framework Gains Traction
The discourse surrounding the legal structure for data protection in Nigeria’s rapidly advancing digital economy is intensifying. Stakeholders have underscored the importance of implementing robust data protection laws that foster digital trust, a critical factor in unleashing the nation’s potential in digital identity and the wider digital economy.
Introduction of the Nigeria Data Protection Act, 2023
This movement culminated in the passage of the Nigeria Data Protection Act, 2023 (NDP Act). This significant legislation establishes a comprehensive legal framework designed to safeguard personal data, ensure accountability, and uphold the digital rights of citizens. The NDP Act replaces outdated regulations and addresses longstanding legal deficiencies while creating the Nigeria Data Protection Commission (NDPC), an authoritative body tasked with enforcing the provisions of this landmark law. However, challenges have surfaced, notably the heavy reliance on consent as the primary legal basis for data processing, complicating the effective implementation of the NDP Act.
Launching the Legal Basis Project
In response to these challenges, the Legal Basis Project was initiated to enhance awareness and practical implementation of the NDP Act among organizations, regulators, and users. The project is set for an official launch in Abuja on October 13, 2025, aimed at elucidating the provisions of the 2023 NDP Act. Spearheaded by Tech Hive Advisory with support from Meta, the initiative has gathered a diverse coalition of participants, including policymakers, legal and technology experts, media representatives, and regulators from the NDPC and associated agencies.
Insights from the Phase 1 Impact Report
The phase one impact report, released six months after the project’s commencement, reflects promising results. The platform attracted 4,360 unique visitors from 72 countries, and its video content has been viewed over 1.58 million times, reaching approximately 1.6 million individuals across various digital platforms. An educational interactive game designed to inform users about data protection principles demonstrated impressive engagement, with a bounce rate of only 41%, significantly lower than the platform’s overall average of 84%.
Research-Driven Foundations
These findings indicate the effectiveness of appealing educational tools in engaging audiences. The report also highlights that the project’s foundation is firmly rooted in thorough research. Prior to the platform’s development, two structured focus group discussions were convened with representatives from key organizations, including the Nigerian Data Protection Commission, National Human Rights Commission, and Federal Competition and Consumer Protection Commission, alongside compliance professionals, civil society advocates, students, and technology users.
Common Concerns and Statistics
From these discussions emerged prevalent concerns about the predominance of consent as the default method for data processing in Nigeria. This reliance is not necessarily based on appropriateness but rather a general lack of awareness regarding alternative legal options. A survey involving over 300 respondents corroborated these findings, revealing that 74% of organizations rely solely on consent for all types of processing.
Additionally, while 69% of respondents emphasized the importance of organizations clearly communicating their legal bases, 56% reported such communications are infrequently provided, illustrating a significant disconnect between user expectations and the information offered.
Engagement and Community Outreach
The project team observed that user engagement aligned with design choices; the consent guide emerged as the most visited page, while the privacy notice builder achieved a remarkable bounce rate of 0%. Eighteen partner organizations have already embedded the platform’s resources into their outreach initiatives. Collaborative efforts with the Nigerian Data Protection Commission have further amplified the platform’s impact, including a successful Data Protection Week event in Ibadan, which drew nearly 1,000 secondary school students in a single day.
Growth and International Reach
Recent analyses indicate substantial traffic growth, particularly around the launch period, driven by community engagement and media coverage. Domestic users constituted 75.8% of total traffic, with the remaining 24.2% coming from the international community, including the Nigerian diaspora and global data protection experts who discovered the platform through organic search and social media. Notable interest has come from foreign users in the United States, United Kingdom, Canada, the Netherlands, and Ireland. User engagement from Germany has been particularly significant, with an average visit duration exceeding 21,000 seconds—around six minutes per visitor—underscoring the relevance of the content. The platform also draws users from 17 African nations, including Ghana, Kenya, South Africa, Sierra Leone, Togo, Cameroon, Benin, and Gambia.
*Joshua Orom writes from Abuja
