Introduction
"No objective author writes in the hope that his or her ideas will be hallowed as sacred articles of faith. Rather, great industry is directed at articulating issues which they believe are worthy of stimulating the critical mind of an objective reader. I therefore commend the law Firm of KENNA and the contributors for their rigorous scholarship and foresight. This work should inspire greater understanding, compliance, and innovation in the field of data protection. It is a call to action to jointly protect data, empower individuals, and build a digital future that reflects our highest values." Dr. Vincent Olatunji, CDPO, CPPPS, FIIMNational Commissioner/CEONigeria Data Protection Commission (NDPC)Abuja, NigeriaSeptember 2025
Preface
Only a couple of years back, the thought of considering data as the new gold would have been a laughable concept. It is, however, where the world currently stands. Data has become so essential to business operations that its value has skyrocketed. From a business perspective, we no longer think of data simply as information but as valuable insights into human behaviour that inform how technology is created, pharmaceuticals are developed, and inform business decisions, including operations, strategy and marketing. The smart use of data can be used to improve almost all facets of human existence, but admittedly, the unrestricted access to and use of data can also have disastrous effects. For the individuals whose data are used, it raises fundamental questions about ownership.
If we define data as identifying information, it follows that those who own such data must be allowed some authority over how their data is used and who gets to use it. In practice, however, individuals cannot always have sole determining authority over how their data is used, and companies cannot have sole determining authority of how to obtain and use such personal data, as there are several public interest aspects of data that require regulatory oversight. Accordingly, data protection laws have evolved through the years from being an aspect of fundamental human rights to robust laws regulating the obtaining, transferring, use, deletion and modification of data.
Data protection laws now try to maintain the balance between the need for institutions to have data with the need to protect the interests of the persons whose data are collected. In Nigeria, the enactment of the Nigeria Data Protection Act, 2023, and the increasing alignment of Nigeria’s regulatory framework with international standards, signal the significant need for not only compliance with extant laws, but also a strategic imperative for organisations across all sectors. The development of data protection jurisprudence has also necessitated our publishing this book on the Legal and Regulatory Aspects of Data Protection.
Woven through the 10 chapters of this book are an overview of the data protection regulatory landscape, the principles of data protection, rights of data subjects, our insights into the practical aspects of data protection from the lens of court judgments and other enforcement mechanisms. Furthermore, against the backdrop of global digital transformation, this book also addresses the implications of cross-border data transfers and the rise of artificial intelligence. Our hope is that this work will serve as both a practical handbook and an insightful resource, equipping its readers to navigate the complexities of compliance while engaging critically with the evolving discourse on privacy and data rights in Nigeria. On behalf of the firm, I commend this publication to all professionals and stakeholders both locally and internationally.
For all individuals, this book provides essential insights into understanding the full scope and extent of your rights as data subjects. Nimma Jo-Madugu, CIPP/E, ACISPartner, Data Protection UnitKENNA
Foreword
It is always cheering to see efforts directed towards the advancement of data privacy and protection in our jurisdiction. Regardless of the positional perspectives of these efforts, we all can acquiesce in the necessity of sustaining our intellectual energy as we push through the decisive frontiers of the 4th Industrial Revolution. This, at least, is an abiding lesson of our liberal education. The book “Legal and Regulatory Aspects of Data Protection” by the law Firm of KENNA, appeals, in a compelling style, to this necessity and I am delighted to write the foreword to it. Indeed, Nigeria’s data governance ecosystem has grown in leaps and bounds since His Excellency, President Bola Ahmed Tinubu, GCFR, signed the Nigeria Data Protection Bill into law.
It is worthy of note that the enactment of the Nigeria Data Protection Act (NDP Act), 2023, marked a watershed moment in our nation’s journey toward a secure, inclusive, and rights-based digital economy. For the first time, Nigeria has a comprehensive, principal legislation which, on the one hand, protects the privacy of individuals, and on the other hand, positions our country as a leader in data governance in international community. The subsequent issuance of the General Application and Implementation Directive (GAID), 2025 by the Nigeria Data Protection Commission (NDPC) has further operationalised this vision, providing clarity, structure, and enforceability to the principles enshrined in the Act. This book, ‘Legal and Regulatory Aspects of Data Protection”, arrives at a critical juncture.
It demonstrates the painstaking efforts of the authors in interrogating the issues of common concern and they have shared practical insights on novel concepts of data governance. The authors provided keen analysis of Nigeria’s evolving data protection ecosystem. In this effort, they addressed foundational principles of the NDP Act; the regulatory role of the NDPC; compliance obligations for data controllers and processors; and the mechanisms for enforcement and redress. In addition, they offered a comparative perspective on the NDP Act and other frameworks such as the EU’s GDPR. From this comparison, the reader can see that the NDP Act and the GAID are not only interoperable with international best practices, that they are also in tune with Nigeria’s socio-economic cum legal landscape.
No objective author writes in the hope that his or her ideas will be hallowed as sacred articles of faith. Rather, great industry is directed at articulating issues which they believe are worthy of stimulating the critical mind of an objective reader. I therefore commend the law Firm of KENNA and the contributors for their rigorous scholarship and foresight. This work should inspire greater understanding, compliance, and innovation in the field of data protection. It is a call to action to jointly protect data, empower individuals, and build a digital future that reflects our highest values. Dr. Vincent Olatunji, CDPO, CPPPS, FIIMNational Commissioner/CEONigeria Data Protection Commission (NDPC)Abuja, NigeriaSeptember 2025
