Nigeria’s data protection framework is attracting international interest, with Sri Lanka’s Data Protection Authority undertaking a study tour of the Nigeria Data Protection Commission (NDPC) to learn from its regulatory experience as the South Asian country strengthens its own data protection ecosystem.

The two-day study tour, themed “Institutional Development, Regulatory Operations and Emerging Priorities in Data Protection,” focuses on Nigeria’s institutional development, regulatory operations and emerging priorities in personal data protection.

Dimuth Bhashitha Atapattu, Director-General of Sri Lanka’s Data Protection Authority, says the country selected Nigeria because of the progress made by the NDPC within a relatively short period.

The visit provides an opportunity for both countries to exchange experiences on building data protection institutions, implementing regulatory frameworks and addressing emerging challenges associated with the processing of personal information.

Spotlight on Nigeria data protection framework

Atapattu explains that Sri Lanka is working to strengthen its data protection ecosystem, prompting the decision to undertake a study tour of the African region, particularly Nigeria.

He adds that the delegation intends to transfer the knowledge gained during the engagement to Sri Lanka and strengthen its partnership with the NDPC.

The visit provides an opportunity for both countries to exchange experiences on building data protection institutions, implementing regulatory frameworks and addressing emerging challenges associated with the processing of personal information.

Welcoming the delegation virtually, Dr. Vincent Olatunji, National Commissioner and Chief Executive Officer of the NDPC, outlines the Commission’s evolution, including the signing of the Nigeria Data Protection Act, 2023, by President Bola Ahmed Tinubu.

Olatunji also highlights the pillars of the Commission’s strategic roadmap and its adoption of a public-private partnership (PPP) model as part of its institutional development and regulatory operations.

He emphasises the impact of Nigeria’s data protection ecosystem on data subjects, data controllers and the wider economy, while highlighting the Commission’s partnerships with other data protection authorities, development partners and stakeholders.

According to Olatunji, the Sri Lankan delegation is the 18th country to visit the NDPC for knowledge exchange.

He assures the delegation of the Commission’s continued support and partnership as Sri Lanka advances its data protection ecosystem.

The engagement reflects the role of international cooperation in strengthening regulatory institutions as countries respond to growing demands for personal data protection in an increasingly digital economy.

For Nigeria, the exchange offers an opportunity to share its regulatory experience with another jurisdiction while learning from the approaches being developed elsewhere.

Ida S. Mboob, Senior Digital Development Specialist at the World Bank Group, commends the NDPC under Olatunji’s leadership for the progress made in developing Nigeria’s data protection ecosystem.

Mboob reflects on the Commission’s journey from its early stages to achieving global recognition within a relatively short period.

The World Bank also receives acknowledgement from Olatunji for supporting the Commission and facilitating the study tour, highlighting the role of development partners in promoting institutional development and international knowledge exchange.

Nigeria’s data protection framework is anchored by the Nigeria Data Protection Act, 2023, which provides the statutory basis for the country’s data protection regulatory system.

The NDPC’s engagement with Sri Lanka comes as data protection authorities face the task of safeguarding individuals’ personal information while supporting organisations that collect, process and use data for business and public services.

Although the study tour is intended to help Sri Lanka strengthen its data protection ecosystem, the specific Nigerian policies or regulatory practices the country may adopt have not been identified in the information released about the visit.

The two-day engagement nevertheless underscores the importance of cooperation between regulators in developing institutional capacity and responding to emerging data protection priorities across different jurisdictions.

For the NDPC, hosting the Sri Lankan delegation adds to its international knowledge-exchange engagements, while Sri Lanka is seeking lessons to support the development of its own regulatory ecosystem.