The National Commissioner of the Nigeria Data Protection Commission, Dr Vincent Olatunji, on Monday said ignorance and widespread distrust of regulators were major factors slowing compliance with Nigeria’s data protection laws.

Speaking at the opening of the second edition of a Data Protection Officers training programme in Abuja, Olatunji said many organisations still misunderstand the role of regulation in business growth.

“Some of them feel regulators are always there to stifle development, not knowing that the private sector is different,” he said.

He added that the commission’s approach was designed to support businesses, not hinder them, noting that trust and confidence were central to digital operations.

“What we’re trying to do is to add value to what they are doing… to ensure that there is trust, there is confidence that will drive traction,” he said.

According to him, organisations that fail to comply risk undermining their own operations, as a lack of trust could weaken customer relationships and business sustainability.

“Because if there is no trust, there is no confidence in whatever they are doing, there is no business,” he added.

Olatunji described data protection regulation as a “developmental” tool that would ultimately improve service delivery and strengthen Nigeria’s digital economy.

He, however, warned that the current phase of awareness and engagement would soon give way to stricter enforcement: “I think very strict. For now, we are still at the level of awareness creation… but after that… if you don’t comply, there are strict penalties, and we are not afraid to issue these penalties.”

The NDPC boss explained that the commission was deliberately taking a gradual approach to avoid harming businesses in a fragile economic environment but stressed that ignorance would no longer be an excuse once awareness levels improve.

On digital lending platforms, Olatunji raised concerns over privacy violations, noting that many operators accessed users’ contacts and personal data without consent.

“If there’s any unauthorised access to the contact information of people, they are giving loans to, it’s an offence. We actually come after them,” he said, adding that several firms were already under investigation.

He also cautioned Nigerians against indiscriminate sharing of personal data, particularly on social media, warning that such actions could constitute legal offences.

“You can be in offence if you share any information without the authorised consent of that subject,” he said.

The commissioner emphasised that data protection rules apply to all entities, including small businesses and individuals operating on platforms such as Instagram and e-commerce sites, noting that anyone who collects or processes data must register with the commission.

“That’s why we are saying everybody who collects and processes data must register with the Commission,” he said.

He disclosed that Nigeria still faces a significant shortage of certified data protection professionals, despite recent progress.

According to him, the number of certified Data Protection Officers has risen from fewer than 1,000 three years ago to over 10,000, while the broader privacy ecosystem now has more than 27,000 professionals.

However, he noted that this remains far below demand, as over 500,000 data controllers and processors require such services.

“The gap of about 480,000 is still there. That is why it’s really important for us to build this capacity,” he said.

Olatunji said the commission aims to position Nigeria as a leading hub for data protection professionals in Africa while supporting job creation in the digital economy.

He added that investigations into data breaches were ongoing, with affected organisations undergoing regulatory processes, including pre-action conferences, before sanctions are issued.

“We don’t rush into taking decisions… we want to ensure that we have actually given you enough time to defend yourself,” he said.

The NDPC reiterated its commitment to enforcing accountability among organisations that collect and process Nigerians’ data, stressing that compliance would become non-negotiable as enforcement intensifies.

President Bola Tinubu signed the Nigeria Data Protection Act into law on 12 June 2023, providing a legal framework for the protection of personal data and replacing the earlier Nigeria Data Protection Regulation.

The law established the Nigeria Data Protection Commission, which has the power to investigate data breaches, conduct regulatory hearings, and enforce compliance among organisations handling personal information.

Since its enactment, the commission has initiated several investigations into alleged violations and imposed sanctions, including fines on firms found to have breached data privacy rules, signalling a shift towards stricter enforcement of the law.