The Nigerian government has moved to enforce stricter data protection compliance across its bureaucracy, ordering every Ministry, Department and Agency (MDA) to appoint and register Data Protection Officers with the Nigeria Data Protection Commission (NDPC), while placing the burden of compliance squarely on the shoulders of top civil servants.
The directive, contained in Circular No. 59805/S.I/74 and dated July 27, 2026, was signed by the Secretary to the Government of the Federation, Senator George Akume.
It represents one of the most forceful attempts yet by Abuja to operationalise the Nigeria Data Protection Act (NDP Act) of 2023 within government institutions themselves, agencies that, ironically, are among the largest custodians of citizens’ personal data, from biometric records to tax and health information.
The circular traces its authority back to President Bola Tinubu, who is quoted as framing data in unmistakably economic terms: “Data is the new oil: its value increases the more it is refined and responsibly shared.”
The analogy, striking for a country whose economy has long been tethered to crude oil exports, signals an attempt to reposition data as a strategic national asset rather than a mere administrative afterthought.
Following that instruction, the SGF’s circular directs MDAs to “capture information rigorously and safeguard it” under the NDP Act, a two-pronged mandate that treats data collection and data protection as inseparable government functions going forward.
Beyond the headline instruction to appoint DPOs, the circular lays out a fairly detailed compliance architecture:
- MDAs must submit the names and contact details of their designated officers to the NDPC for formal registration.
- Where internal capacity is lacking, agencies are to engage licensed Data Protection Compliance Organisations (DPCOs), third-party firms accredited to support audits and compliance programmes.
- Agencies must budget specifically for data protection: staff training, public awareness campaigns, technical safeguards, and periodic audits.
- MDAs are required to file mandatory Data Protection Compliance Audit Returns and other statutory returns within legally prescribed timelines.
Notably, the circular does not stop at institutional obligation; it personalizes it.
Permanent Secretaries, Accounting Officers, and Chief Executive Officers are now explicitly on the hook, a provision seemingly designed to close the accountability gap that has historically let compliance directives in Nigerian public service go unenforced.
In April, NDPC had already urged data controllers and processors, including MDAs, to urgently strengthen their technical and organizational measures, recommending steps such as multi-factor authentication, zero-trust architecture, and continuous vulnerability patching, citing escalating cyber threats.
The July circular appears to formalize and elevate those earlier advisories into binding administrative policy.
The regulatory environment has also been evolving on the standards side. In late June, the NDPC issued a Guidance Notice establishing a structured framework for assessing the continuous professional development of Data Protection Officers, reinforcing competency requirements that any newly appointed DPOs across MDAs will presumably need to meet.
Private-sector compliance has been running on a parallel track: the deadline for filing 2025 Compliance Audit Returns was originally set for March 31, 2026, and later extended to May 30, 2026. According to industry trackers, a timeline gives some indication of how the NDPC typically phases in enforcement and hints at what MDAs might expect once their own audit-return obligations kick in.
The NDP Act itself was signed into law by President Tinubu in June 2023, establishing the NDPC as Nigeria’s data protection authority.
Since then, the Commission has refined its enforcement posture: in March 2025, it issued the General Application and Implementation Directive, which formally replaced the older Nigeria Data Protection Regulation of 2019. That directive, now in force, is the specific instrument MDAs are being told to comply with.
Under the substantive law, the obligation to appoint a DPO is not new in principle; the Act already requires Data Controllers of Major Importance to designate a Data Protection Officer responsible for internal compliance and for serving as liaison with the NDPC.
What the July circular does is extend that requirement unambiguously to federal MDAs and attach personal liability to the exercise.
Reacting to the directive, NDPC Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, confirmed the circular’s contents in a statement issued in Abuja, while National Commissioner Dr Vincent Olatunji welcomed it as evidence of the administration’s commitment to protecting citizens’ privacy and fundamental rights.
The Commission says it has also set up a regulatory clinic to walk MDAs through the implementation part of a broader outreach push that has recently included initiatives such as a Nollywood-styled privacy awareness campaign run jointly with Mastercard, aimed at building a wider culture of data protection compliance beyond government circles.
Olatunji has tied the initiative to Tinubu’s eight-point Presidential Priorities agenda, arguing that data accountability underpins the administration’s digital transformation ambitions.
Whether the directive translates into genuine institutional change, however, will depend on execution. Nigerian public agencies have a long history of ambitious circulars that struggle against underfunding, weak enforcement follow-through, and civil-service inertia.
The personal-liability clause for permanent secretaries and agency chiefs suggests the government is aware of this risk and is trying, at least on paper, to preempt it.
For now, the ball is in the court of MDAs: register their DPOs, budget for compliance, and brace for audits with the NDPC positioned as both regulator and, through its new clinic, reluctant tutor.
WHAT YOU SHOULD KNOW
The Federal Government’s July 27, 2026, circular marks a decisive shift from advisory to enforceable action on data protection within its own MDAs.
Every agency must now appoint and register a Data Protection Officer, budget for compliance, and submit audit returns to the NDPC, or risk falling foul of the law it is meant to model.
The single most important takeaway is the personal-liability clause: Permanent secretaries, accounting officers, and CEOs of MDAs are now individually accountable for their institution’s compliance, not just the institution itself.
That detail is what separates this circular from previous data protection advisories; it’s designed to make non-compliance costly for the people in charge, not just an abstract institutional failing.
