In anticipation of its upcoming enforcement drive in 2024, the Nigeria Data Protection Commission (NDPC) has taken a proactive step by issuing a comprehensive Code of Conduct for Data Protection Compliance Organizations (DPCOs) in Nigeria. The move aims to ensure a high level of professionalism among firms licensed to provide compliance services.
Addressing a gathering of DPCOs during a crucial meeting, the National Commissioner, Dr. Vincent Olatunji, emphasized the pivotal role DPCOs play in implementing the Nigeria Data Protection Act (NDPA) 2023. Dr. Olatunji urged them to consider their responsibilities as a public trust that demands a profound sense of responsibility. He highlighted the opportunities embedded in the NDPA, particularly emphasizing the lawful use of data and the potential for job creation in the data processing value chain.
Under section 33 of the NDPA 2023, the Commission possesses the authority to license individuals with the requisite expertise related to data protection. These licensed individuals are empowered to monitor, audit, and report on compliance by data controllers and data processors. This innovative Public Private Partnership model is designed to foster trust and confidence in Nigeria’s digital economy, mirroring similar initiatives worldwide.
Aligned with the newly issued Code of Conduct, DPCOs are authorized to offer a range of compliance services, including but not limited to awareness and capacity building, registration of data controllers or processors, development and implementation of compliance schedules, NDPA compliance audits, filing of compliance audit returns, data privacy impact assessments, and facilitating and vetting data privacy agreements.
To operate as a DPCO and provide compliance services, firms must obtain a license from the Commission and have a certified Data Protection Officer. As of November 2023, the Commission has already licensed 163 DPCOs.
Presenting the Code of Conduct to the DPCOs, the Commission’s Head of Legal, Enforcement, and Regulations, Babatunde Bamigboye, Esq, delved into the target objectives and principles outlined in the code. These include Privacy Consciousness, Capacity Building, Accountability, Data Ethics, and Corporate Social Responsibility. DPCOs are expected to adhere to these principles and will be held accountable according to the provisions of the NDPA, the Code of Conduct, and any future regulatory instruments issued by the Commission.
