The Nigeria Data Protection Commission (NDPC) has teamed up with the Federal Ministry of Health and Social Welfare to champion data privacy reforms across Nigeria’s healthcare system.
According to a statement by the Head of Media Unit at NDPC, Itunu Dosekun, the strategic alliance was announced during a working visit by NDPC’s National Commissioner/CEO, Dr Vincent Olatunji, to the Coordinating Minister of Health, Professor Muhammad Ali Pate.
Dr. Olatunji noted that with Nigeria’s healthcare sector rapidly embracing digital transformation, the need to protect patients’ personal and medical records has never been more urgent.
Processing of sensitive data
The NDPC CEO observed that from hospitals and HMOs to diagnostic labs and research institutions, healthcare providers are collecting vast amounts of personal information — much of it extremely sensitive.
“This sector is generally sensitive, and the kind of information collected has to do with medical records, which could be used to discriminate against anyone seeking to have good healthcare,” Dr Olatunji said.
- He emphasized that data breaches in the sector could lead to serious consequences such as misdiagnosis, discrimination, and in extreme cases, even loss of life.
- Dr Olatunji walked the Health Minister through the evolution of data protection in Nigeria, tracing it from the 2019 Nigeria Data Protection Regulation (NDPR), to the creation of the Nigeria Data Protection Bureau, and eventually the landmark NDP Act of 2023.
- This legal foundation, he noted, not only established Nigeria’s framework for data governance but also earned the country a seat at the table of the Global Privacy Assembly — a testament to its growing global recognition in data privacy.
Data protection industry
Olatunji said the collaboration also ties into President Bola Tinubu’s broader push to create jobs in the digital economy.
According to him, the data protection sector has already become a N10 billion industry, with more than 10,000 certified professionals now in the ecosystem — up from fewer than 5,000 just two years ago.
He estimates that with over 500,000 data controllers in Nigeria and only 10,000 certified Data Protection Officers (DPOs), there’s room to create up to half a million new jobs.
Health Ministry on board
Professor Pate welcomed the partnership, describing the healthcare sector as a “unique” space where large volumes of personal and demographic data are collected daily.
He expressed confidence in the NDPC’s strategy and affirmed the Ministry’s commitment to ensuring compliance across its 107 associated agencies.
He also raised pertinent questions about how the NDP Act applies to data processed outside Nigeria and whether research data and biodiversity information are adequately protected.
Dr Olatunji clarified that the law has an extraterritorial reach.
“Even if you are outside Nigeria, once you process the data of Nigerians, you are within scope — and that’s why we are currently investigating global platforms like Truecaller and TikTok,” he said.
He also explained that any cross-border data transfers must meet strict standards through an “adequacy decision” to ensure that Nigerians’ rights are protected.
What you should know
Last month, the NDPC unveiled the Nigeria Data Protection Act – General Application and Implementation Directive (NDP Act-GAID), which provides comprehensive guidelines to help data controllers and processors comply with the law.
- The Commission described the directive as a significant milestone in Nigeria’s data privacy efforts, particularly as emerging technologies continue to reshape digital interactions.
- The directive covers critical areas such as data protection principles, lawful bases for data processing, data subjects’ rights, cross-border data transfers, compliance audit returns, and standardised grievance redress mechanisms.
