Federal Government Issues Compliance Circular On Data Protection And Responsible Data Governance For MDAS

INTRODUCTION

The Federal Government has issued a Compliance Circular directing all Ministries, Departments and Agencies ("MDAs") to strengthen compliance with the Nigeria Data Protection Act, 2023 (“NDPA”) and all regulations, guidelines and directives issued by the Nigeria Data Protection Commission (“NDPC”).1

The Circular, signed by the Secretary to the Government of the Federation, introduces specific governance and compliance measures for MDAs and places renewed emphasis on institutional accountability for the lawful processing of personal data.

WHAT MDAs ARE REQUIRED TO DO

1. Appoint a Data Protection Officer: Every MDA is required to designate a qualified officer as a Data Protection Officer (“DPO”) to oversee compliance with the NDPA and advise management on matters relating to the lawful processing of personal data. MDAs should therefore assess whether their current DPO arrangements satisfy the expectations set out in the Circular.

2. Notify the NDPC of the Designated DPO: The Circular requires MDAs to communicate the name and contact details of their designated DPO to the NDPC for registration and official records.

3. Engage a Licensed DPCO Where Required: Where necessary, MDAs are expected to engage licensed Data Protection Compliance Organisations (“DPCOs”) to support compliance with the NDPA and facilitate statutory compliance audits. This recognises that external technical and regulatory support may be required to meet the NDPA's compliance obligations.

4. Allocate Adequate Resources for Compliance: The Circular requires MDAs to make adequate budgetary provision for data protection compliance activities. These include:

1. staff capacity building;
2. awareness programmes;
3. deployment of appropriate technical safeguards; and
4. periodic compliance audits.

5. Submit Statutory Compliance Returns: MDAs are required to submit mandatory Data Protection Compliance Audit Returns and all other statutory returns to the NDPC within the timelines prescribed by law. Failure to maintain timely regulatory filings may expose institutions to enforcement action under the NDPA.

6. Ensure Executive Oversight: A notable feature of the Circular is its emphasis on leadership accountability. Permanent Secretaries, Accounting Officers and Chief Executive Officers are made personally responsible for ensuring institutional compliance with both the Circular and the NDPA. This places responsibility for data protection governance at the highest level of public sector management.

IMPLICATIONS FOR MDAs

The Circular signals a more structured and accountable approach to public sector data protection compliance. MDAs should consider undertaking an immediate review of their existing compliance arrangements to ensure that all the requirements of the Circular have been implemented.

For institutions that require additional technical or regulatory support, the Circular expressly contemplates the engagement of licensed Data Protection Compliance Organisations to assist with compliance implementation and statutory audit obligations.

Alongside the Circular, the NDPC announced the establishment of a Regulatory Clinic to provide technical support to MDAs in implementing their obligations under the NDPA. According to the Commission, the initiative forms part of broader efforts to strengthen responsible data governance across the public sector.

CONCLUSION

The Compliance Circular reinforces the Federal Government's expectation that data protection compliance should form an integral part of public sector governance. MDAs should take proactive steps to review their governance frameworks, compliance processes and reporting arrangements to ensure continued alignment with the NDPA and the Circular.