NDPC releases code of conduct for data protection compliance organisations 

Joy Agwunobi

The Nigeria Data Protection Commission (NDPC) has released a code of conduct for the 163 licensed data protection organisations (DPCOs) in Nigeria. The code of conduct outlines best practices and standards that DPCOs are expected to follow in order to protect and secure the data of individuals and organisations. It also specifies the responsibilities of DPCOs towards their clients and the public, as well as the obligations that DPCOs have towards the NDPC.

The release of the code of conduct is part of the NDPC’s ongoing efforts to regulate the data protection industry in Nigeria. The code is intended to ensure that DPCOs adhere to high professional standards and provide quality services to their clients. The NDPC has stated that the code of conduct will be enforced from 2024 onwards, and that DPCOs will be required to comply with its provisions.

In addition to releasing the code of conduct, the NDPC has also issued a guidance notice to all data controllers and processors in Nigeria. The notice urges these organisations to file compliance audit returns in order to be included in the National Data Protection Adequacy Programme (NaDPAP) Whitelist. The NaDPAP Whitelist is a list of data controllers and processors that have been deemed to be compliant with data protection regulations by the NDPC.

At a recent meeting with data protection compliance organisations,Vincent Olatunji, the national commissioner, highlighted the important role that DPCOs play in implementing the Nigeria Data Protection Act. He noted that DPCOs have a responsibility to act with the utmost professionalism and accountability when it comes to protecting and handling data. He also highlighted the opportunities created by the Act, such as the ability to lawfully use data and the potential for job creation in the data processing sector.

Section 33 of the Nigeria Data Protection Act (NDPA) of 2023 empowers the NDPC to license organisations with the necessary expertise to monitor, audit, and report on the compliance of data controllers and processors with the Act. The public-private partnership model is an important part of the NDPA’s overall framework and is intended to foster trust and confidence in Nigeria’s digital economy.

As the world becomes increasingly digitalised, data processing has become a crucial component of national economies. The NDPA recognizes this and has put in place a framework that protects the rights of individuals while promoting the responsible use of data.

According to Babatunde Bamigboye, the head of legal, enforcement and regulations at the NDPC, the code of conduct has several target objectives and principles, including privacy consciousness, capacity building, accountability, data ethics, and corporate social responsibility.