ABUJA — The Nigeria Data Protection Commission (NDPC) has issued a high-level regulatory advisory, ordering organizations nationwide to immediately reinforce their data security measures. The directive comes following technical findings that reveal shadowy threat actors are carrying out coordinated operations against Nigeria’s financial systems and other critical national assets.

In the advisory signed by the Head of Legal, Enforcement, and Regulations, Babatunde Bamigboye, the Commission warned that the escalating sophistication of these threats poses a direct risk to national security and the privacy of citizens.

Mandatory Security Upgrades

The NDPC has directed all Data Controllers and Processors, including Ministries, Departments, and Agencies (MDAs) and private sector operators to urgently step up their technical and organizational safeguards. The NDPC 11-Point Security Directive:

• Professional Oversight: Appointment of duly trained and certified Data Protection Officers (DPOs).
• Policy Development: Effectual implementation of Privacy Policies and information security standards.
• Risk Assessment: Carrying out mandatory Data Privacy Impact Assessments (DPIA).
• Access Control: Deployment of robust identity controls, specifically Multi-Factor Authentication (MFA).
• Modern Architecture: Implementation of zero-trust security architecture and network segmentation.
• Vulnerability Management: Immediate remediation of system flaws and continuous patch management.
• Infrastructure Security: Securing cloud environments, APIs, databases, and access credentials.
• Active Surveillance: Implementation of real-time monitoring, logging, and threat detection mechanisms.
• Data Protection: Use of encryption, key management, and secure credential handling.
• System Testing: Regular conduct of Vulnerability Assessment and Penetration Testing (VAPT) on all critical systems.
• Resilience Planning: Consistent backup, recovery, and resilience testing to ensure business continuity.

Regulatory Compliance and Enforcement

The Commission reminded institutions of their statutory obligations under the Nigeria Data Protection Act, 2023. Beyond technical fixes, the NDPC emphasized that organizations must appoint certified Data Protection Officers (DPOs) and conduct rigorous Data Privacy Impact Assessments (DPIA) for all data processing activities.

“Data is the new oil; its value increases the more it is refined and responsibly shared. I therefore direct all Ministries, Extra-Ministerial Departments and Agencies to capture information rigorously and safeguard it under the Nigeria Data Protection Act 2023,” stated a referenced directive from President Bola Ahmed Tinubu.

Consequences of Non-Compliance

The NDPC warned that enforcement mechanisms are already active. Organizations that fail to implement these heightened security measures risk legal liabilities, including administrative fines and criminal prosecution.

The advisory follows a period of intense digital activity in Nigeria, which has seen the country become a more prominent target on the global cyber threat landscape. While the NDPC has pledged regulatory support to help institutions align with best practices, the primary responsibility for safeguarding the personal data of millions of Nigerians now rests squarely on the shoulders of data-handling entities.