The senate committee on ICT and cyber security has proposed an amendment to the National Data Protection Act 2023.
The proposed amensment is in response to the growing threat of cybercrime and the rapid advancement of artificial intelligence technologies in Nigeria.
Afolabi Salisu, senator representing Ogun central and chairman senate committee on ICT and cyber security, discloses this at the opening of a three-day data protection awareness workshop for members of the joint national assembly committee on ICT.
The workshop was facilitated by the Nigeria Data Protection Commission (NDPC) in partnership with Ampersand Development Partners.
Salisu said the review had become necessary due to emerging global realities, including advances in AI systems, growing cross-border cyber threats, and new international frameworks such as the United Nations Convention on Cybercrime.
“There is a nexus between data governance and cybercrime, hence the need to review the Act and strengthen it where necessary to protect our national interest,” he said.
The senator said cybercrime had become more sophisticated globally, with criminals increasingly exploiting AI tools, digital platforms, and weak data governance systems to target individuals, businesses, and governments.
He said Nigeria has recorded a steady rise in cyber-related offences, including identity theft, financial fraud, ransomware attacks, data breaches, and digital espionage affecting financial institutions, telecom operators, government agencies, and private citizens.
The committee chairman said concerns had also increased over the misuse of personal data by digital platforms, mobile applications, and online service providers that harvest users’ information without adequate safeguards or consent.
He added that security experts had repeatedly warned that Nigeria’s expanding digital economy and rising internet penetration leave the country more vulnerable without stronger regulatory systems.
Salisu said lawmakers must develop adequate knowledge of the digital space to legislate effectively.
“As legislators, we need to understand data privacy and protection. You cannot legislate in an area you are not sufficiently knowledgeable about,” he said.
He said the workshop would help lawmakers assess the implementation of the 2023 Act and identify areas requiring improvement in line with global best practices.
Salisu added that deliberations at the workshop would shape a roadmap and timeline for the amendment process.
The senator also cautioned Nigerians about hidden risks associated with digital platforms and free online services, noting that many mobile applications, public WiFi networks, and online platforms collect and process personal data without users fully understanding the implications.
Also speaking, Stanley Olajide, chairman, house committee on ICT and cyber security, said data would drive Nigeria’s next phase of prosperity more than oil.
Olajide said foreign investors would be reluctant to bring capital into Nigeria without strong data protection laws and regulatory safeguards.
The lawmaker described data as part of Nigeria’s sovereign wealth and emphasised the need for stronger legal frameworks to protect citizens and institutions against data breaches.
“Whatever data that we have is our sovereign wealth, is something that belongs to us,” he said.
“How do we protect it? We have to make sure that the right legal frameworks are put in place, so that the data, once breached, you can actually hold entities, corporations, the countries responsible when they breach your data law.”
Olajide said countries such as the United States already operate strict laws governing data stored within their jurisdictions.
“In the US, they have their data law; if you put anything in their cloud, it is owned by the United States. So we also have to have something here,” he said.
“Anything that resides here in Nigeria and is generated here must be home and protected by our country; so we are put in the right laws and framework in place just to do that.”
Nigeria enacted the National Data Protection Act in 2023 to regulate the processing of personal data, safeguard privacy rights, and establish the NDPC as the country’s primary data protection regulator.
