Nigeria: Data Protection

Nigeria's July 2026 regulatory landscape witnessed sweeping reforms across insurance recapitalisation, digital sovereignty requirements, VAT framework revisions, and virtual assets coordination. How are these interconnected policy shifts reshaping compliance obligations for businesses operating in Africa's largest economy, and what strategic adjustments must organisations make to navigate this evolving regulatory environment?

The Federal High Court has affirmed the statutory powers of the Nigeria Data Protection Commission (NDPC) to register Data Controllers and Data Processors of Major Importance (DCPMIs) under the Nigeria Data Protection Act (NDPA), 2023. In a judgment delivered on 28 July 2026 by Honourable Justice F.N. Ogazi in Emmanuel Harunna v. Nigeria Data Protection Commission (FHC/L/CS/1116/2024), the court dismissed the applicant’s contention that Point of Sale (PoS) agents should not be classified as Data Controllers or Processors subject to the Commission’s registration regime.

On 17 August 2026, Nigeria's Federal Government released its National Digital Cloud Policy, superseding the 2019 framework to establish a domestic cloud and data infrastructure ecosystem. The Policy introduces fiscal and regulatory incentives for qualifying investors, mandates cloud-first adoption across government agencies, and implements a four-tier sovereign data classification system that confines data residency requirements to specific categories rather than imposing blanket localisation.

Organizations around the world depend on digital systems to collect and process personal information of employees, customers, and vendors. Over time, much of this information has migrated from traditional on-site infrastructure to cloud-based systems, changing the methods by which personal data is stored, managed, and transmitted across jurisdictions.

In the legal profession, maintaining confidentiality in the course of practice is not just a principle, it is a daily ethical conduct. This is not unconnected to the sensitivity of the legal sector and the fact that legal practitioners and paralegals handle sensitive information of clients which carries significant implications if exposed or leaked. Ethically, client information is expected to be kept confidential, hence the attorney-client privilege serving as the legal pillar underpinning that obligation.

Nigeria's open banking framework promises to transform digital lending through secure, consent-driven financial data sharing. As the phased rollout approaches mid-2026, lenders face both opportunity and obligation: faster credit decisions, better risk assessment, and new product possibilities, alongside stricter compliance requirements and infrastructure dependencies that will reshape competitive dynamics across the sector.

Nigeria's Central Bank has introduced sweeping data localisation requirements that will fundamentally reshape how payment service providers, banks, and financial institutions handle transaction data. With a January 2027 compliance deadline, these new rules mandate that all payment transaction data generated within Nigeria must be stored and managed locally, raising critical questions about cloud infrastructure, vendor relationships, and operational readiness. This analysis examines the scope of the requirem

Nigeria's new National Identity Management Commission Act 2026 introduces sweeping reforms to the country's digital identity infrastructure, making the National Identification Number mandatory for essential services while designating NIMC as the nation's Root Certificate Authority. The legislation imposes significantly harsher penalties for identity offences and reconstitutes NIMC's governance structure, but questions remain about data protection safeguards and the concentration of power within a single ins

Nigeria's Internet Code of Practice 2026 introduces a 48-hour breach notification requirement for Internet Access Service Providers, creating a shorter timeline than the Nigeria Data Protection Act 2023 and raising questions about overlapping regulatory obligations. This development reflects a broader global trend toward sector-specific cyber resilience requirements that demand earlier visibility into cyber incidents.