Licensed Data Protection Compliance Organisation DataPro Limited has projected a surge in individual privacy claims and constitutional lawsuits in 2026, with organisations urged to remain “litigation ready” by preserving data processing records and strengthening internal controls.
This was disclosed in a statement signed by Head of Emerging Services Ademikun Adeseyoju and made available to The PUNCH on Tuesday, ahead of the firm’s commemoration of its 2026 Privacy Week, themed ‘Privacy in the Age of Emerging Technologies: Trust, Ethics, and Innovation’.
The PUNCH reports that Nigeria transitioned from the Nigeria Data Protection Regulation to the full statutory power of the Nigeria Data Protection Act and the General Application and Implementation Directive in 2025. 2026 will mark the first full year of enforcement of the new laws.
DataPro said, “The year 2025 marked Nigeria’s definitive transition from guidelines-based compliance to a mandatory, enforcement-driven regime,” the company stated, adding that privacy compliance had become “a core legal and governance obligation rather than a best-effort exercise.”
It noted that this shift was underscored by an “active regulatory posture” from the Nigeria Data Protection Commission, which publicly named non-compliant entities, particularly in the financial services sector.
On the outlook for the year, the firm said, “Looking ahead, DataPro predicts that 2026 will be defined by Board and Executive Ownership. Privacy will no longer be an IT-only concern but a standing governance issue requiring regular risk reports and dedicated budgets. We also anticipate a surge in individual claims and constitutional privacy actions, meaning organisations must remain “litigation ready” by preserving processing records and strengthening internal controls. Furthermore, DataPro anticipates intensity on Sector-Specific Enforcement, with the NDPC focusing on high-risk industries like Fintech, Healthcare, etc.”
According to DataPro, the courts also played a significant role in reshaping the ecosystem during the year, with landmark rulings affirming privacy as a constitutionally protected right.
“Judicial precedents in 2025 affirmed that transparency in personal data handling is a constitutionally protected right. Courts awarded significant damages to data subjects for privacy breaches, signalling that organisational size no longer shields against accountability,” the firm said.
It added that regulatory settlements involving multinational technology firms had set higher standards for behavioural advertising and data processing in Nigeria, reinforcing the message that global companies were equally subject to local data protection laws.
Concerning cybersecurity, DataPro said 2025 witnessed an unprecedented surge in threats, with attackers shifting from purely technical exploits to identity-driven campaigns.
“Attackers shifted their focus from technical exploits to identity-driven campaigns, targeting valid credentials with high precision,” the company said. “This identity-centric threat environment has made robust access management a non-negotiable requirement for corporate resilience.”
As part of efforts to prepare organisations for the year ahead, DataPro announced activities lined up for its 2026 Privacy Week, including the publication of its Privacy Pulse report, a compliance-focused webinar, interactive cyber response quizzes, and social media engagements aimed at demystifying complex privacy issues.
“This week-long observance serves as an inflection point for analysing the tectonic shifts in Nigeria’s data protection landscape while preparing organisations for the rigorous demands of the coming year,” the company stated.
