By Chidiebere Nwankwo
Companies and institutions that have not yet complied with registration and certification of their data processes with the National Data Protection Commission (NDPC) runs the risk of being sanctioned, as the NDPC says it has started Enforcement processes to ensure compliance.
Speaking in Lagos of Wednesday at a meeting with Data Protection and Compliance Officers from different parts of the country, the National Commissioner and CEO of NDPC, Dr. Vincent Olatunji disclosed that his office, in the past two weeks, has gradually moved from capacity building/awareness stage to enforcement.
He noted that NDPC has started sending out letters to financial officers to comply, with a 21-day notice before penalties will be meted out.
Dr. Olatunji implored all public and private sector establishments to seek out designated Data Protection and Compliant Officers (DCPOs) for registration, training and Data Audit.
“As we speak, we have about 291 DPCOs in Nigeria and we evaluate them on regular basis. Last year we revoked 19 licences based on the quality of work they did. This year, we are at the point of reviewing their work and the amount of Audit Filing they have done,” he announced.
“Our vision is to have a culture of compliance in the country, were we don’t have to run after you to comply.
We have already investigated some companies, and some of them have been compelled to pay remediation fees, because what we are doing is not only yet penalties. Penalties will be huge, but even in terms of reputation, the effect is going to be negative.”
He noted that with the remediation fees, that is not penalties, have brought in over N400 million to federal coffers. “And that is remediation, not even fines. But very soon we will start applying full sanctions and issue fines, more especially to those who are not ready to comply with the commission in terms of breaches.
So when there are breaches, after proper evaluation, we review the impact of the breach, the number of data subjects affected, the sensitivity of the breach, these are the things we look at, and if they are not too major, what we do is to take them through compliance. And part of the process of taking them through compliance is for them to pay their remediation fee and do a proper evaluation of their data activities; where there are no conformities, we will give them time to conform.”
He further explained that the essence of standardizing data processes in Nigeria is to ensure security of data, and gain confidence from foreign investors.
He further charged DPCOs to up their game in sensitizing and registering organisations, noting that th performance of most of them are not encouraging.
“So we are telling them here today that we are monitoring the work they do. And they have a key role to play in registering data Processors and controllers of major organisations. So, what we have received from end of March to now, when we started the campaign for registration, is still very low. The onus is on them to go out for advocacy, to talk to their clients, to bring them on board, to register them. We try to encourage them. That is part of what we are discussing with them.”
“This is the most strategic ecosystem in the country today. All organisations, private sector, public sector, civil society groups, they collect and process data. So this is one area that connects all sectors – education, aviation, health, agriculture, entertainment. That means we can play in every sector.”
He therefore charged DPCOs to also take the message to small and medium enterprises (SMEs) where there are about 40 million registered entities, and help them with their registration and certification.
The Commission is saddled with the responsibility of securing data repository in the country, ensuring the responsible use of public data and ensuring that any establishment that handles data is certified to do so. The aim is to deepen data privacy in Nigeria
Speaking on the level of compliance, Dr. Olatunji said: “It terms of compliance, it is getting better. In the first year Audit Compliance Report that we received was 632, now we are doing over 3000, which is commendable. However, the number of Data Controllers and Processors that we are expecting to register or file out annual report of compliance is not less than 100,000. That is even at the rate of 20% compliance to about 500,000 that we have in the country. So we need to do more to bring them on board, to register them, to know them and to even know where we are headed and know the plans we can put in place for them.
The National Data Protection Board (NDPB) was set up in February 2022 through the National Data Protection Regulation (NDPR) which was instituted in 2017. The Board was designated as a Commission in a 2023 Act signed into law by President Bola Tinubu on June 12, given the powers of an independent Commission and data regulator.
