NDPC plans review of Nigeria’s data protection Act to address AI and other emerging technologies

The Nigeria Data Protection Commission (NDPC) has revealed plans to make adjustments to the Nigeria Data Protection Act (NDPA) 2023. The review seeks to address emerging technologies such as artificial intelligence, robotics and advanced computing. 

Per reports, the announcement was made by the National Commissioner of NDPC, Dr Vincent Olatunji, on Friday in Abuja while commemorating three years since the NDPA was signed into law by President Bola Tinubu on June 12, 2023.

The Act established a comprehensive legal framework for safeguarding the personal information of individuals residing or doing business in Nigeria. It was a move that officially established the NDPC as an independent regulator to oversee data privacy.

Explaining the need for the review, Olatunji said technology shifts have made some of the Act’s provisions obsolete and due for an update.  

“We are in the era of emerging technologies. At that time, we could only make general references to emerging technologies, but today we can specifically mention Artificial Intelligence, robotics and big data,” he said.

The NDPC boss pointed out that when the Act was drafted, the ecosystem was less advanced, which prevented the consideration of emerging technologies in the law. He added that this made it broader and more general than specific.

“Ten years ago, nobody was talking about AI the way we are now, but today it has become central to virtually every aspect of digital transformation. We need to be more specific about what constitutes emerging technologies and provide examples because the technologies keep evolving,” he added.

Providing more context on the way forward, Olatunji mentioned that the Act must move from vague references to emerging technologies. This allows the NDPA to address the technologies that shape Nigeria’s ambition for an all-round digital economy.

He added that the digital footprints and other privacy-related contexts are areas requiring continuous regulatory attention and review to keep pace with technological shifts.

The Act, aside from establishing data regulation and usage, repealed and replaced the older Nigeria Data Protection Regulations (NDPR) of 2019.

Also Read: NDPC and Meta launch major data protection program to strengthen privacy in Nigeria.

NDPC: AI still needs human oversight

As the NDPA will be undergoing a review to accommodate emerging technologies such as AI, Olatunji emphasised that human control must remain central to how AI systems are deployed.

The NDPC boss projected Nigeria’s data privacy ecosystem will reach new heights in the next five years. He explained how the commission has been building a culture of privacy that attracts international investors to see Nigeria as a country ready for digital business. 

Olatunji said Nigeria’s system of conducting regular reviews on its data protection laws sets it apart from other countries that have continued to operate under a framework signed over a decade ago. 

“I see growth, development, awareness and greater trust in the ecosystem. Compliance will become a necessity rather than an option. The rights, freedoms and interests of Nigerians and legal residents will be adequately protected,” he added. 

The NDPC boss assured that the commission wants to keep reviewing the NDPA periodically, a move tailored at preventing the framework from becoming obsolete considering how digital technologies continue to rapidly emerge.