Nigeria: Data Protection

In a significant development, largely unprecedented in Nigeria, the Central Bank of Nigeria ("CBN") issued a Circular titled Introduction of Market Structure Requirements, Data Localisation...

A quiet contest is underway across Africa over the housing and use of data, raising a fundamental question: where does African data live, and whose law governs it? As the continent generates a rising share of global digital activity yet hosts only about one percent of the world's data centre capacity, the answer carries real economic and legal weight that will determine who controls, profits from, and bears the costs of Africa's digital future.

Nigeria has issued a new National Digital Cloud Policy, and it carries very consequential implications. It replaces the 2019 Nigeria Cloud Computing Policy, reframes cloud infrastructure as a matter of national economic strategy rather than routine government IT, and sets out, for the first time, a coordinated framework covering investment, government adoption, and data sovereignty in a single instrument. For anyone building, financing, hosting on, or advising in Nigeria’s digital economy, it is pivotal to re-evaluate alongside the Policy. read.

In June, Nigeria witnessed the roll out of several policies and legislative developments across governance, taxation, financial regulation, digital identity, public health and institutional reform, reflecting the Government’s concerted effort to leverage law and policy as instruments for addressing emerging challenges, strengthening public institutions and advancing national development objectives.

Nigeria's National Identity Management Commission (Establishment) Act, 2026 introduces significant reforms to the country's identity management framework. This legal analysis examines the key provisions and their implications for data protection, privacy rights, and regulatory compliance in Nigeria's evolving digital identity landscape.

The Federal High Court sitting in Lagos, has delivered its judgment in Emmanuel Harunna v Nigeria Data Protection Commission.1 The applicant instituted an action against the Nigeria Data Protection Commission (NDPC), arguing that the Commission wrongly classified him as a Data Controller and Data Processor of Major Importance under the Guidance Notice.2

As artificial intelligence tools like ChatGPT become increasingly prevalent in legal practice, Nigerian law firms face a critical decision: embrace the technology's productivity gains or risk falling behind competitors. With over 1,490 documented cases of AI-generated fabrications submitted to courts worldwide, the question isn't whether lawyers can use ChatGPT, but how to harness its power without destroying careers through hallucinated case law, confidentiality breaches, or regulatory violations.

Agentic AI systems operate autonomously, making decisions and processing data in ways users cannot predict or control. This creates a fundamental mismatch between existing data-protection frameworks built on notice-and-choice principles and the reality of how these systems collect, infer, and share personal information. The article examines whether current consent models, controller definitions, and liability frameworks can adequately govern AI agents that independently chain data sources

The AfCFTA Digital Trade Protocol is evolving from framework to operational instrument, with eight new annexes adopted in February 2025 covering rules of origin, cross-border payments, and data transfers. As Africa's digital economy races toward a projected $712 billion by 2050, businesses and governments face critical decisions about compliance, market access, and regulatory alignment. What practical steps should stakeholders take now to prepare for implementation, and how will ratification timelines affec