" ITREALMS: Reflections on Nigeria Data Protection Regulation 2019 by Pantami - ITREALMS

Tuesday, April 16, 2019

Reflections on Nigeria Data Protection Regulation 2019 by Pantami - ITREALMS

When I left the comfort and security of an academic environment to become a public servant in a sector that the President is so passionate about, I was never under the illusion that it would be smooth sail. 

Indeed, Nigeria’s success in Information Technology development and regulation holds the key to her sustainable development, it can be no other way. This is because the nation is blessed with a young and vibrant population of digital natives. So, on my appointment, I went into deep and intensive study of National Information Technology Development Agency (NITDA)’s mandate, stakeholders and vision. 

My study made me realise that to assume we could execute all the mandate, is absolutely impossible in one lifetime. This made the crafting of an actionable plan a priority on my assumption of office, these plan, we believe, is germane for our national development. We agreed to focus on: IT Regulation; Local Content Development; Digital Jobs Creation; Digital Inclusion; Cybersecurity; Government Digital Services Promotion and Development and Capacity building.

Initial steps on IT regulation was met with resistance by internal and external stakeholders. People assumed regulation always meant obstruction and restriction on innovation. It took a while for people to realise our regulatory paradigm was developmental regulation. I would share a story to illustrate this concept. Our Local Content in ICT Guidelines was issued in 2013 with the aim of growing local content in ICT products and services provision. A multinational which had sold software in the country for over 20 years and made millions of dollars in licensing fees, suddenly had an issue with its local support partner and therefore appointed a foreign support partner for its Nigerian clients. NITDA moved in, investigated and ensured other Nigerian companies were evaluated and one was eventually picked to continue the service. This move made the Nigerian clients happy and retained over 200 jobs for Nigeria. This was regulatory enforcement leading to more jobs and keeping more Nigerians happy.

I am happy to report that our modest efforts at NITDA have started yielding bounteous dividends for the nation. Through the active support of Nigerians, NITDA has catalyzed the purchase of indigenous brand of ICT devices, there has been a sales increase by over 400%. While local hosting of data has doubled in value and local software consumption has significantly improved. The cumulative effect of these, is that ICT contribution to GDP in nominal terms reached an unprecedented mark of 13.63% in Q4 of 2018. This, for us is a tip of the iceberg considering the initiatives which are still in the works. One such initiative I am so proud of, is the Nigeria Data Protection Regulation 2019.

The coming into force of the European Union General Data Protection Regulation (EU GDPR) in May 2018 threw the global community into a frenzy of sorts. The GDPR mandates controllers of European citizens data to comply with certain detailed rules and principles or risk incurring a fine of up to 4% of the defaulter’s global turn-over. This situation made many small and medium scale service providers to lose their share of the European market. More importantly, the rate of wanton abuse of the privacy of Nigerian citizens data needed an urgent national response. I therefore constituted a team of young professionals in the Agency, I challenged them to proffer a solution to this problem. This team worked hard and eventually came up with a unique Regulation that has become the cynosure of discerning minds.

Here is a quick glance at the core principles of the NDPR.

a) Lawfulness and Legitimacy: Article 2.1(1a) provides that Personal Data shall be collected and processed in accordance with specific, legitimate and lawful purpose consented to by the Data Subject.

b) Specific Purpose: In addition to Article 2.1(1a) cited above, Article 3.1(7c) mandates the Data Controller to expressly inform the Data Subject of the purpose(s) of the processing for which the Personal Data are intended as well as the legal basis for the processing. This has hitherto been observed in the breach. This, we believe would change as government is poised to stem the tide of brazen breach of people’s right to privacy.

c) Data Minimization: Data Controllers are expected to collect the minimum required data and avoid unnecessary surplusage. Data that is not useful for the Controller ought not to be collected. No data shall be obtained except the specific purpose of collection is made known to the Data Subject. This principle relates also to the principle on purpose of collection. By insisting that the purpose for collecting or further processing of a data set must be communicated to the Data Subject, the regulation has closed the door to a multitude of potential abuses.

d) Accuracy: The NDPR provides that collected and processed Personal Data shall be adequate, accurate and without prejudice to the dignity of human person (Art. 2.1(b)). The NDPR prohibits the abuse or inaccurate representation of personally identifiable data, even if such data where given with due consent. Data Controllers and processors are required to ensure regular update of personal data in their custody to achieve this.

e) Storage and Security: Data Controllers are required to store data only for the period they are reasonably required to so do. The Regulation does not explicitly provide for a time period because that detail, we believe should be left to contract agreement. However, where such is not specified, the dispute redress mechanisms can specify what would constitute sufficient storage period. The Regulation also places the onus of security on the Data Controller and Processor. Art. 2.1(d) provides- personal data shall be secured against all foreseeable hazards and breaches such as theft, cyberattack, viral attack, dissemination, manipulations of any kind, damage by rain, fire or exposure to other natural elements.

f) Confidentiality, Integrity and Availability: Article 3 generally enumerates the rights of the data subject. One of the underpinning principles of the NDPR is that data control must comply with basic minimum standards of information security management. The Regulation specifies the role of the Controller and the Data subject in such case.

g) Compliance and Enforcement: One of the novelties of the NDPR is its compliance structure. The Regulation creates a nouveau class of professionals- Data Protection Compliance Organisations (DPCO). A DPCO is any entity duly licensed by NITDA for the purpose of training, auditing, consulting and rendering services and products for the purpose of compliance with this Regulation or any foreign Data Protection Law or Regulation having effect in Nigeria (See Article 1.3 (xiii)). These professional firms would provide requisite training, services and other support to Data Controllers to aid their compliance with the NDPR. I hope to come back to the immense potentials of this arrangement shortly.

On enforcement the NDPR classified Controllers into large and small categories. Those who process data of more than 10,000 data subjects are liable to forfeit 2% of their Annual Gross Revenue (AGR) while those handling less than 10,000, would lose up to 1% of their AGR. The NDPR would both bark and it would bite errant data controllers.

One of my greatest sources of joy on the Regulation is the job creation potential. Over 1.5 million businesses and non-governmental organizations would need to file Data Audit Report on or before 15th March of every year. Each of these reports must bear a Verification Statement, sign and seal of a Licensed DPCO. If each DPCO provides service for an average of 50 Data Controllers, we would need over 300,000 professionals to meet this need. Imagine the jobs our young people can generate and sustain through this service alone. Because this is not public procurement, we have made the entry barrier high enough to admit only serious-minded people and low enough to allow Start-ups to engage without undue intimidation.

This, for us is the beginning of a new era and we crave the support of all Nigerians to support and sustain this effort. We also look forward to receiving constructive comments, opinions and technical observation to ensure that this Regulation is optimally implemented for the betterment of our dear nation and people.

*Contributed by Dr Isa Ali Ibrahim (Pantami), Director General/CEO National Information Technology Development Agency (NITDA).
*JOIN our alert's group | Share stories with us | Advert placement: WhatsApp | SMS: +2348033592762 *Twitter: @ITREALMS *Email: itrealms.dsa@gmail.com*

40 comments:

markson said...

Excellent Information Systems Ltd. is an ISO 9001:2008 guaranteed supplier of Mac, Linux, Novell and Windows information recuperation administrations, has denoted its place in this particular field.ExcelR Data Science Courses

CloudLearn ERP said...

Great writing! You have a flair for informational writing. Your content has impressed me beyond words. I have a lot of admiration for your writing. Thank you for all your valuable input on this topic. Best Data Science training in Mumbai

Data Science training in Mumbai

data science said...

I just stumbled upon your blog and wanted to say that I have really enjoyed reading your blog posts. Any way I’ll be subscribing to your feed and I hope you post again soon #Artificial Intelligence course in Malaysia | #Artificial Intelligence training in Malaysia | #Ai course | #Ai Training

Gaurav said...

It is perfect time to make some plans for the future and it is time to be happy. I've read this post and if I could I desire to suggest you some interesting things or suggestions. Perhaps you could write next articles referring to this article. I want to read more things about it!
360DigiTMG data science training in indore

Artificial Intelligence Course said...

You have completed certain reliable points there. I did some research on the subject and found that almost everyone will agree with your blog.

Artificial Intelligence Course in Bangalore

PMP Certification in Hyderabad said...

It's really nice and informative, it has all the information and it also has a big impact on new technologies. Thanks for sharing it. PMP Certification in Hyderabad

360digiTMG Training said...

I really enjoy simply reading all of your weblogs. Simply wanted to inform you that you have people like me who appreciate your work. Definitely a great post. Hats off to you! The information that you have provided is very helpful.
Data Science Training in Hyderabad

saketh321 said...

This is a splendid website! I"m extremely content with the remarks!ExcelR Data Analytics Course

Data Science Course in Mangalore said...

Impressive. Your story always bring hope and new energy. Keep up the good work.

Data Science Course in Mangalore

Data Science Course in Mangalore said...

After reading your article I was amazed. I know that you explain it very well. And I hope that other readers will also experience how I feel after reading your article.

Data Science Course in Mangalore

Dataxpoinstitute said...

It is perfect time to make some plans for the future and it is time to be happy. I’ve read this post and if I could I desire to suggest you few interesting things or tips. Perhaps you could write next articles referring to this article. I want to read more things about it!

Data Science Course in Mysuru

Big Data 360 said...

Its as if you had a great grasp on the subject matter, but you forgot to include your readers. Perhaps you should think about this from more than one angle.

Data Science Course in Trichy

traininginstitute said...


Pretty good post. I just stumbled upon your blog and wanted to say that I have really enjoyed reading your blog posts. Any way I’ll be subscribing to your feed and I hope you post again soon.

business analytics course

traininginstitute said...

I think I have never seen such blogs before that have completed things with all the details which I want. So kindly update this ever for us.


Best Data Science courses in Hyderabad

traininginstitute said...

Thanks for such a great post and the review, I am totally impressed! Keep stuff like this coming.
Best Data Science courses in Hyderabad

traininginstitute said...

This is a really very nice post you shared, I like the post, thanks for sharing...
digital marketing courses in hyderabad with placement

training institute said...

I am sure that this is going to help a lot of individuals. Keep up the good work. It is highly convincing and I enjoyed going through the entire blog.
data scientist course in malaysia

training institute said...

I like viewing web sites which comprehend the price of delivering the excellent useful resource free of charge. I truly adored reading your posting. Thank you!
data science training

Unknown said...

It is extremely nice to see the greatest details presented in an easy and understanding manner. data analytics training in delhi

Bhuvankumar said...
This comment has been removed by the author.
Bhuvankumar said...


Wonderful blog post. It's absolute magic on your part! Hope you continue like this!
Data Analytics Training in Bangalore

Tech Institute said...

Really, this article is truly one of the best in the article. And this one that I found quite fascinating and should be part of my collection. Very good work!.
Data Science Training in Jaipur

Unknown said...

Very nice blog and articles. I am realy very happy to visit your blog. Now I am found which I actually want. I check your blog everyday and try to learn something from your blog. Thank you and waiting for your new post. business analytics course in surat

data analytics courses malaysia said...

All things considered I read it yesterday yet I had a few musings about it and today I needed to peruse it again in light of the fact that it is very elegantly composed.

PMP Training in Malaysia said...

360DigiTMG, the top-rated organisation among the most prestigious industries around the world, is an educational destination for those looking to pursue their dreams around the globe. The company is changing careers of many people through constant improvement, 360DigiTMG provides an outstanding learning experience and distinguishes itself from the pack. 360DigiTMG is a prominent global presence by offering world-class training. Its main office is in India and subsidiaries across Malaysia, USA, East Asia, Australia, Uk, Netherlands, and the Middle East.

Unknown said...

If your looking for Online Illinois license plate sticker renewals then you have need to come to the right place.We offer the fastest Illinois license plate sticker renewals in the state. data science training in kanpur

Unknown said...

I recently came across your article and have been reading along. I want to express my admiration of your writing skill and ability to make readers read from the beginning to the end. I would like to read newer posts and to share my thoughts with you. data science course in mysore

Anand said...

Such a very useful article. Very interesting to read the article. I would like to thank you for sharing this awesome article.
Business Analytics Course in Ahmedabad

Swarnalatha said...

You can watch some video tutorials and hear online lectures about each of the programming languages. To conclude, it is right to say that you have to be good at programming to succeed in data science.data science training in ludhiana

Jack Bravo said...

I am truly glad to happen by these style of posts. I am talking about it with my friends as they are additionally looking for this type of informational posts.
url opener

data science course in patna said...

It has increases the importance of the field. If you have also been attracted by the value of data science and want to learn it, you have to understand the basic courses of data science you need to learn to move successfully in the industry.
data science course in patna

Umrah Packages UK said...

Splendid realities and also detailed information provided in this small content. Awaiting much more blog posts like this one.

Unknown said...

I am extremely more than happy to come by these sort of updates. I am discussing it with my buddies as they are potentially looking for this sort of informative blog posts.
uwatchfree
playtubes

Nethan Kummar said...

I'd been having problems for a few weeks, but your post helped me figure out how to fix them.

Uwathfreemovies
Turkish series

Hangarscript said...

Spoofer is a type of software that temporarily or permanently changes your hardware ID. Your old hardware ID will become invalid because this software changes the identity of your computer. So when you try to enter the game, anti-cheat checks all your hardware IDs from the remote server. If you have a hardware ID on the remote server, it will not let you into the game. But if you use a spoofer and enter, you can enter the game because your hardware IDs have changed. The game has certain rules and policies and you will be penalized if you do not follow them. We call punishment ban. And bans can be temporary or permanent. Today I will tell about hardware ban.


Maddy Crusoe said...

When someone asks how to "convert 7 lb to kg," what do they mean?
Weight can be measured in either lbs or kg. In Europe, the pound is the go-to weight unit. Thanks to 120 lbs to kg-co.uk, converting between lbs and kilogrammes is a breeze. Input your information into the fields provided at https://www.lbs-to-kg.co.uk/. .and see a spike in your conversion rate right away.

chrispine said...

Very informative Blog! There is so much information here that can help thank you for sharing. Star Trek Picard Field Jacket

My Homes Fix said...

I am truly glad to happen by these style of posts. I am talking about it with my friends as they are additionally looking for this type of informational posts. AC Mechanic Near Me

Seriale le turcesti said...

Urmăriți Pe All Serialele Turcesti 2023 Netflix Online. Urmărește Serialul Românesc Gratis Online Streaming Video HD. You Can Enjoy It TV Shows And Seriale Turcesti Comedii Romantic And Filme De Dragoste Streaming For Free

Dealul vanturilor ep said...

Urmariti Online Serial Drama, Actiune, Drama, Si Comedie, Seriale Turcesti Vechi sau Nou in situatii foarte odihnitoare. Asta înseamnă că inima ta se simte confortabil seriale turcești comedie romantică, atât de mult încât te simți confortabil. Vă puteți bucura și, de asemenea, să împărtășiți cu prietenii și cu Faimly.

Featured post @ITREALMS

Segun Olatunji returns: Why we must protect free press, democracy against military misconduct - ITREALMS

ITREALMS ... making leadership SENSE with digital news! As the cheering news of the return of abducted the Editor, FirstNews, Mr Segun Olatu...