Federal Government Directs MDAs To Strengthen Data Protection And Responsible Data Governance

The Federal Government has issued a compliance directive¹ to all Ministries, Departments and Agencies (MDAs) to fully comply with the Nigeria Data Protection Act 2023 (NDP Act).² The Circular seeks to strengthen public trust by promoting responsible personal data governance and reinforcing accountability across the public sector.

The Circular, signed by the Secretary to the Government of the Federation, H.E. Senator George Akume, CON, on the directive of President Bola Ahmed Tinubu, GCFR, underscores the strategic importance of data to national development. It reiterates the President's position that "data is the new oil" and emphasises that its value is enhanced through its responsible collection, sharing and refinement. Accordingly, all MDAs are now explicitly required in no uncertain terms to process personal data in line with the NDPA and all regulations, directives and guidelines issued by the Nigeria Data Protection Commission (NDPC).³

The directive places primary responsibility for compliance on Permanent Secretaries, Accounting Officers and Chief Executive Officers of all MDAs, who are required to ensure that their respective institutions fully implement the requirements of the Act. As part of these obligations, every MDA is required to designate a qualified Data Protection Officer (DPO) to oversee compliance, advise management on data protection matters, monitor lawful processing activities, serve as the institution's liaison with the NDPC, and ensure that the names and contact details of their designated DPOs are communicated to the Commission for registration and official records. MDAs are also expected to notify the Commission of their DPO appointments, make adequate budgetary provisions for data protection compliance activities, including staff capacity building and technical safeguards, engage licensed Data Protection Compliance Organisations (DPCOs) where necessary, and submit annual Data Protection Compliance Audit Returns and other statutory returns within the prescribed timelines.

Reacting to the development, the National Commissioner/Chief Executive Officer of the NDPC, Dr. Vincent Olatunji, expressed the Commission’s commitment to supporting data-driven governance within the public sector. He described data accountability as central to achieving the eight Presidential Priorities and announced that the Commission has constituted a Regulatory Clinic to provide MDAs with the necessary technical support to achieve full compliance. The Circular represents a significant step in the Federal Government's efforts to institutionalise privacy, accountability and responsible data governance in the public sector, following earlier measures such as the 2022 circular issued by the Office of the Secretary to the Government of the Federation on service-wide compliance with the Nigeria Data Protection Regulation (NDPR), which similarly imposed data protection compliance on MDAs.⁴ The initiative is described as part of a continuous regulatory measure to advance Nigeria towards the frontiers of the Fourth Industrial Revolution.

Key Takeaways

1. All MDAs are required to comply with the NDPA and all regulations, directives and guidelines issued by the NDPC.
2. Every MDA must designate a qualified Data Protection Officer (DPO), notify the NDPC of the appointment, and empower the DPO to oversee institutional compliance.
3. MDAs are required to allocate adequate budgetary resources for data protection compliance, including staff training, technical safeguards and other compliance measures.
4. Where necessary, MDAs should engage licensed Data Protection Compliance Organisations (DPCOs) to support compliance with their statutory obligations.
5. MDAs must submit annual Data Protection Compliance Audit Returns and other statutory filings to the NDPC within the prescribed timelines.
6. Permanent Secretaries, Accounting Officers and Chief Executive Officers bear primary responsibility for ensuring institutional compliance with the Circular.
7. The NDPC has established a Regulatory Clinic to provide technical assistance and implementation support to MDAs in achieving full compliance.

Footnotes

1. Circular No. 59805/S.I/74, dated 27th July and Issued on 4 August 2026.

2. Nigeria Data Protection Act, 2023 (Act No. 37, Official Gazette No. 119, Vol. 110, Government Notice No. 82).

3. NDPC’s Press Release: ‘Federal Government Issues compliance circular to MDAs on Data Protection and Responsible Data Governance’, available at (https://www.linkedin.com/posts/press-release-fg-issues-compliance-circular-ugcPost-7490351873997213696-8B3N/?utm_source=share&utm_medium=member_desktop&rcm=ACoAADr0bLMBMFnS3cPCsykUEdt0WU4p_guQvjs) accessed on 8 August 2026.

4. ‘NDPC’ Circular Ref. No. SGF/OP/I/S.3/XI/186, dated 7 November 2022, available at (https://ndpc.gov.ng/resources/#flipbook-df_2429/3/ ion) accessed on 10 August 2026.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.