--- title: "Nigeria — Sectoral Watch | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/nigeria/sectoral-watch/ source_html: /jurisdictions/nigeria/sectoral-watch/index.html description: "Nigeria — Sectoral Watch: sectoral_watch Sectoral Watch 7 sub-modules 4 claims Amber ▾ # Financial and telecoms sector overlays are confirmed and actively enforced; health, education, credit-scoring and insuran" generated_at: 2026-10-25T04:46:50Z content_sha256: aedeb693c69f6a7902be35250ba40531e21fd7465e14ea5e6834a8754ff9ae95 generator: "fe-fleet/md-twin@1.0" --- # Nigeria — Sectoral Watch | Data Protection Monitor ### D6Sectoral Watch7 sub-modules4 claimsAmber▾# Financial and telecoms sector overlays are confirmed and actively enforced; health, education, credit-scoring and insurance sector overlays are unconfirmed from available sources. Primary framework Nigeria Data Protection Act, 2023 (NDPA) with sectoral overlays (CBN, NCC) Supervisory authority [Nigeria Data Protection Commission (NDPC)](https://ndpc.gov.ng/) Traffic-light rationale — Amber Financial and telecoms sector overlays are confirmed and actively enforced; health, education, credit-scoring and insurance sector overlays are unconfirmed from available sources. #### Sub-modules (7) #### Financial Sector OverlayAmber CBN Consumer Protection Regulation (Art. 5.4) and CBN risk-based cybersecurity framework (2022) apply alongside NDPA to financial institutions; NDPC has fined a major bank for data breach. Claims (3): - NDPC recognises the Central Bank of Nigeria's Consumer Protection Regulation (Article 5.4) as a complementary instrument alongside the NDPA. - The Central Bank of Nigeria issued a risk-based cybersecurity framework and guidelines for other financial institutions on 29 June 2022, covering cybersecurity oversight, risk management and reporting. - NDPC fined Fidelity Bank NGN 555.8 million for data protection violations, evidencing active enforcement against financial-sector data controllers. #### Health Sector OverlayRed No confirmed health-sector-specific data protection overlay was located for NG. #### Telecoms And EprivacyAmber NCC's Consumer Code of Practice Regulations (Part IV) is referenced by NDPC as a complementary instrument for telecoms-sector personal data. Claims (1): - NDPC recognises Part IV of the Nigerian Communications Commission's Consumer Code of Practice Regulations as a complementary instrument to the NDPA. #### Employment DataRed No confirmed employment-specific data protection overlay was located for NG. #### Credit And ScoringRed No confirmed credit-scoring-specific data protection overlay was located for NG. #### EducationRed No confirmed statutory education-sector data protection overlay was located; NDPC has pursued voluntary partnerships with universities. #### InsuranceRed No confirmed insurance-sector-specific data protection overlay was located for NG. Category narrative 79 words The NDPA operates alongside sector regulators; NDPC explicitly recognises complementary instruments including the Central Bank of Nigeria's Consumer Protection Regulation and the Nigerian Communications Commission's Consumer Code of Practice Regulations. CBN separately issued a risk-based cybersecurity framework for financial institutions in June 2022. NDPC has actively enforced against financial-sector and media/telecom-sector entities, evidenced by fines against a major bank and a pay-TV operator. Confirmed sector-specific overlays for health, education, credit-scoring and insurance were not located in this research pass. Periodic update · new data 2026-10-18 #### Sectoral Watch Two recent NDPC actions illustrate active regulatory engagement with sector-specific data practices. In the financial sector, NDPC has opened an investigation into Remita Payment Services Ltd. and Sterling Bank following reports of a suspected cyberattack and claims of exposed sensitive customer and institutional data circulating on dark-web forums. In the media sector, NDPC fined MultiChoice Nigeria N766,242,500 for unlawful cross-border transfer of Nigerians' personal data and violation of subscribers' and non-subscribers' privacy rights, following an investigation opened in the second quarter of 2024. Taken together, these two actions, in payments and broadcasting respectively, indicate that NDPC's sectoral attention is not confined to a single industry but is being applied wherever cross-border transfer or breach exposure arises, regardless of sector. #### Outlook Whether NDPC's sectoral attention extends further, to other financial-sector processors or other media and telecommunications entities handling comparable volumes of subscriber data, is the key signal to watch as the Remita/Sterling Bank investigation develops. 1 earlier distinct update(s) Periodic update · new data 2026-10-11 #### Sectoral Watch The financial-services sector in Nigeria now carries a distinct data-localisation obligation layered on top of the general Nigeria Data Protection Act framework. The Central Bank of Nigeria issued Circular PSS/DIR/PUB/CIR/001/004 on 15 June 2026, signed by Rakiya O. Yusuf, directing that all payment-transaction data generated within Nigeria be stored and managed within Nigeria, and that this storage be conducted in accordance with data protection laws. The circular sets full compliance by 1 January 2027, placing it in enacted-but-not-yet-effective status at the time of this cycle: payment firms are on notice of the obligation but have a defined compliance runway before it takes legal effect. This is a sectoral overlay rather than a general NDPA requirement, and its significance lies in the precedent it sets for sector-specific regulators layering data-residency requirements on top of the Act's general, technology-and-sector-neutral framework. The NDPA itself does not impose a blanket data-localisation requirement; its cross-border transfer provisions instead apply an adequacy-and-safeguards test to international transfers generally. The CBN circular's requirement that in-country storage be conducted in accordance with data protection laws suggests the Central Bank intends compliance with its localisation mandate to be read alongside, rather than as a substitute for, the Nigeria Data Protection Commission's existing framework, though the precise mechanics of how the two regimes interact — for instance whether a payment firm's NDPA-compliant cross-border transfer of transaction data would nonetheless breach the CBN circular — were not resolved in material reviewed this cycle. The obligation's addressee is explicitly the payment firm sector, and its 1 January 2027 effective date gives the sector roughly six and a half months from the circular's issuance to localise data-storage infrastructure. Given the materiality that this monitor assigns to sectoral financial-data requirements, this circular should be treated as a standing compliance deadline for payment firms operating in Nigeria, distinct from and additional to their general NDPA obligations. #### Outlook The period leading up to 1 January 2027 is the operative window in which payment firms must complete data-localisation compliance under Circular PSS/DIR/PUB/CIR/001/004. Whether the Central Bank or the National Data Protection Commission issues further joint or clarifying guidance on how the localisation mandate interacts with the NDPA's cross-border transfer regime is the principal open question carrying into subsequent cycles; absent such guidance, payment firms are left to reconcile the two regimes without explicit regulatory direction. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Evidence 4 Sources and claims (4) - Probable[NDPC](https://ndpc.gov.ng/about-us/) — NDPC recognises the Central Bank of Nigeria's Consumer Protection Regulation (Article 5.4) as a complementary instrument alongside the NDPA.observed 2026-08-07 - Probable[OneTrust DataGuidance](https://www.dataguidance.com/news/nigeria-cbn-issues-risk-based-cybersecurity-framework) — The Central Bank of Nigeria issued a risk-based cybersecurity framework and guidelines for other financial institutions on 29 June 2022, covering cybersecurity oversight, risk management and reporting.observed 2026-08-07 - Probable[OneTrust DataGuidance](https://www.dataguidance.com/news/nigeria-ndpc-fines-fidelity-bank-ngn-5558m-data) — NDPC fined Fidelity Bank NGN 555.8 million for data protection violations, evidencing active enforcement against financial-sector data controllers.observed 2026-08-07 - Probable[NDPC](https://ndpc.gov.ng/about-us/) — NDPC recognises Part IV of the Nigerian Communications Commission's Consumer Code of Practice Regulations as a complementary instrument to the NDPA.observed 2026-08-07