UUBO seeks stakeholder collaboration in implementing NDP Act
From Left: Oyindolapo Olusesi, Lead, Legal Services and Data Protection Officer, Kora; Jumoke Lambo, Managing Partner, Udo Udoma & Belo-Osagie; Vincent Olatunji, The National Commisioner/CEO, the Nigeria Data Protection Commision; Obianuju Otudor, Manager, Commercial Legal Department, MTN Nigeria Communications Plc., and Krish Ranganath, Regional Executive, West Africa, Africa Data Centres at the 2025 Udo Udoma & Belo-Osagie Data Protection Breakfast Session held in Lagos.
Members of the Udo Udoma & Belo-Osagie (UUBO) have advocated stakeholder collaboration in implementing the Nigerian Data Protection NDP Act.
They spoke at a Data privacy breakfast held in Lagos recently.
Themed, ‘the GAID in practice: Navigating Nigeria’s New Privacy Directives,’ Managing Partner at UUBO Jumoke Lambo, in her welcome remarks, disclosed the event was organised to provide opportunity for regulators, policymakers, in-house counsel, data protection officers, and industry leaders exchange insights on the implementation of the Nigerian Data Protection (NDP) Act General Application and Implementation Directives (GAID).
Saying the NDP landscape continues to evolve, she added the regulator, the Nigeria Data Protection Commission (NDPC), continues to set the pace as one of the most active data protection authorities across the continent.
In his presentation, Vincent Olatunji, National Commissioner/Chief Executive Officer Nigeria Data Protection Commission (NDPC) described the GAID as operational blueprint for NDP Act, 2023, issued by the Commission on March 20th 2025.
With the aim of providing clarity and practical guidance on implementation of the NDP Act, 2023, he disclosed the Act takes effect from September 19th 2025, replacing the NDPR 2019 as the nation’s principal regulatory guide.
Specifically, Olatunji spoke on Principles of Data Protection; NDP Act Compliance Audit Returns; Data Protection Officer’s Assessment; Data Privacy Impact Assessment; Guidance on Cross-Border Data Transfer; Data Subject Vulnerability Indexes; legitimate Interest Impact Assessment Template; Data Subject’s Standard Notice to Address Grievances and NDP Act Compliance Audit Returns Filing Fee.
Speaking further, he added complying with the NDP Act GAID is not just a regulatory requirement, but a strategic enabler for trust, innovation, and sustainable growth.
Concerning Data Protection Officers (DPO), he said their contact must be publicly available and communicated to the Commission; annual credential assessment of DPOs will be conducted to ensure they maintain requisite level of professionalism to carry out their responsibilities; the DPO is required to submit a semi-annual report to management on the data protection status within the organization; the DPO should have unrestricted access to personal data and processing activities to effectively fulfil their role; the DPO must operate independently, free from undue influence to ensure objectivity; the DPO must maintain confidentiality regarding their work.’
In conclusion, he noted, “the successful implementation of the NDP Act depends on cooperation among all stakeholders (data subjects, government, businesses, Civil Society Organisations and the media). Through this collective effort, we can transform compliance into opportunity, strengthening governance, improving services, and enhance Nigeria’s global competitiveness.”
