The Nigeria Data Protection Commission (NDPC) has taken a significant step toward strengthening data protection in the healthcare sector through a strategic partnership with the Federal Ministry of Health and Social Welfare.
The partnership underscores the critical importance of safeguarding sensitive patient information and ensuring strict compliance with the Nigerian Data Protection Act, 2023. It aims to address the pressing challenges within Nigeria’s evolving health data landscape while aligning with the collaborative strategies set out as priorities under President Bola Tinubu’s administration.
These issues were brought to light during a working visit by the national commissioner of NDPC, Dr. Vincent Olatunji, to the Minister of Health and Social Welfare, Prof. Muhammad Pate in Abuja.
Olatunji provided an overview of the commission’s mandate and emphasised the urgency of implementing strong data protection practices in the healthcare sector. He stressed that healthcare professionals and policymakers must create systems that uphold the confidentiality, integrity and security of personal health data. According to him, data breaches in healthcare can have serious consequences, including discrimination, incorrect treatment and, in extreme cases, loss of life.
“This sector is generally sensitive, and the kind of information collected has to do with medical records, which could be used to discriminate against anyone seeking to have a good healthcare,” Olatunji stated.
He highlighted the global shift toward digital systems and noted that each online interaction leaves a “digital blueprint” of personal information. He pointed out the need to establish secure data environments across all healthcare institutions — from hospitals to health management organisations (HMOs) and any entities handling patient data.
Olatunji explained the evolution of data protection in Nigeria, tracing its journey from the introduction of the Nigeria Data Protection Regulation (NDPR) in 2019, to the establishment of the Nigeria Data Protection Bureau and, finally, to the signing of the Nigeria Data Protection Act in 2023. This legislative progress, he said, paved the way for Nigeria’s admission into the Global Privacy Assembly, signifying international recognition of the country’s commitment to data privacy.
On capacity development, he stated that when the initiative began, fewer than 5,000 professionals were qualified to operate in the data protection ecosystem. “Today, we have over 10,000 trained data protection professionals across the country,” he said.
He also disclosed that within just two years, the data protection sector has grown into a 10 billion Naira economy, with enormous potential for further job creation. “Nigeria has over 500,000 data controllers. We currently have just 10,000 certified data protection officers (DPOs). This gap presents an opportunity to create about half a million jobs for Nigerians in line with Mr President’s goal of creating 2 million jobs in the digital economy sector,” he explained.
In his response, Pate acknowledged the sensitive nature of health data and commended the insights provided by Olatunji. “The health sector is a unique sector. We collect extensive data — from personal health details to demographic statistics — across all our facilities,” he noted.
The minister expressed satisfaction with the commission’s progress and reiterated the ministry’s commitment to full compliance across its 107 associated institutions. He also raised critical questions regarding the extraterritorial scope of the NDP Act, its approach to regulating harmful external data, and the protection of sensitive research and biodiversity information.
Olatunji clarified that the NDP Act, 2023 applies to any data controller or processor managing the personal data of Nigerians, whether operating within the country or abroad. “If you reside in Nigeria and process Nigerian data, you are within scope. Even if you are outside Nigeria, once you process the data of Nigerians, you are within scope — and that’s why we are currently investigating global platforms like Truecaller and TikTok,” he said.
He further explained the legal framework for cross-border data transfers, which requires an “adequacy decision” to ensure foreign jurisdictions meet data subject rights protections and maintain comparable legal standards.
Olatunji assured Pate that the law includes provisions for safeguarding scientific and research-related data, reaffirming the NDPC’s preference for encouraging compliance through public awareness and education rather than immediate enforcement.
As part of the broader education effort, the NDPC collaborates with licensed data protection compliance organisations (DPCOs) to help institutions achieve full compliance. Olatunji offered to conduct free training sessions for healthcare workers to build a foundational understanding of data privacy principles. “We’re happy to offer free induction training for your staff — to build foundational understanding of data protection principles,” he said.
Pate welcomed the training initiative and invited the NDPC to present at the next meeting of the Committee of Chief Medical Directors. He noted that such a session would help increase awareness and commitment to data protection among senior healthcare managers and decision-makers.
In a statement issued by the head of the commission’s media unit, Itunu Dosekun the engagement between the NDPC and the ministry marks a pivotal milestone in enhancing Nigeria’s healthcare data protection framework. The collaboration is expected to strengthen public trust and ensure the safety of sensitive health data belonging to all Nigerian citizens. A joint implementation team has been constituted to take the partnership forward.
