The Nigeria Data Protection Commission (NDPC) says it has begun validating a new data privacy framework for Nigeria’s e-commerce sector as regulators move to strengthen oversight of how online businesses collect, process and use consumers’ personal data.

The framework, being developed through a partnership between the NDPC and the German Corporation for International Cooperation (GIZ), is designed to strengthen consumer trust, promote responsible data use and improve compliance with Nigeria’s data protection laws.

It will, according to the data protection agency, also examine privacy risks associated with the unlawful collection and processing of personal information, including profiling, as well as the potential consequences for businesses that fail to comply with the Nigeria Data Protection Act (NDPA) 2023.

The development of the framework comes as Nigeria’s digital marketplace expands and e-commerce platforms increasingly depend on personal information to process transactions, personalise services, assess customers and support digital marketing.

NDPC targets e-commerce data practices

Speaking at the validation workshop, Dr Vincent Olatunji, National Commissioner and Chief Executive Officer of the NDPC, said the expansion of e-commerce must be matched by stronger safeguards for the personal information generated through digital transactions.

Online businesses rely extensively on data ranging from customers’ names and contact details to payment, behavioural and transaction information, he said.

Consumers, he added, must therefore have confidence that their information is being handled responsibly, securely and lawfully.

“Businesses can only truly thrive when customers, as data subjects, are confident that their personal data is handled responsibly, securely and lawfully,” Olatunji said.

The commissioner said trust is a critical component of Nigeria’s digital economy, arguing that stronger privacy protections could support innovation while giving consumers greater confidence to participate in digital commerce.

“A trusted digital marketplace encourages innovation, strengthens consumer confidence and creates an environment where businesses can grow sustainably,” he said.

Profiling emerges as a privacy concern

The proposed framework will examine risks associated with the unlawful collection and processing of personal data, including the use of information to profile consumers.

Profiling can involve analysing personal or behavioural information to understand or predict characteristics, preferences or activities of individuals.

For e-commerce businesses, such practices can form part of targeted advertising, customer segmentation, personalised recommendations and other data-driven services.

The NDPC’s focus suggests that businesses operating in the sector will increasingly be expected to demonstrate that such processing has an appropriate legal basis and is carried out in accordance with data protection requirements.

The framework is also expected to address the implications of non-compliance with the NDPA 2023, which provides the legal basis for protecting personal data in Nigeria.

NDPC signals broader sector-specific regulation

The e-commerce initiative forms part of the Commission’s wider move towards developing sector-specific data protection and privacy frameworks.

In June 2026, the NDPC said it had commenced work on frameworks covering sectors including telecommunications, financial services and hospitality, with stakeholder participation forming part of the regulatory process.

The approach recognises that data protection risks can vary significantly between sectors depending on the nature of information collected, how it is processed and the potential consequences of misuse.

For e-commerce businesses, the regulatory focus is particularly relevant because digital transactions can generate multiple categories of personal information within a single customer interaction.

A typical online transaction can involve identity and contact details, payment information, purchase history, delivery information, device data and behavioural information.

The growing volume and variety of such data increases the importance of appropriate safeguards throughout the data lifecycle, from collection and storage to processing, sharing and eventual deletion.

GIZ partnership supports privacy framework

Olatunji acknowledged GIZ’s continued support for the Commission, saying collaboration between government, development partners, businesses and other stakeholders would be necessary to build a trusted digital ecosystem in Nigeria.

He reiterated the NDPC’s commitment to ensuring that technological innovation does not come at the expense of privacy and accountability.

The validation process provides an opportunity for stakeholders in the e-commerce ecosystem to contribute to the development of a framework that reflects the operational realities of digital businesses while strengthening protections for consumers.

NDPA establishes Nigeria’s data protection regime

The Nigeria Data Protection Act 2023, which came into force in June 2023, established the NDPC as Nigeria’s independent data protection authority and created the country’s principal legal framework for the regulation of personal data processing.

The law places obligations on organisations that process personal data and provides rights and protections for individuals whose information is collected and processed.

The Commission’s increasing focus on sector-specific frameworks points to a more targeted phase of data protection regulation, where general statutory requirements are complemented by guidance tailored to the risks and practices of individual industries.

For Nigeria’s e-commerce sector, the emerging framework could therefore have implications for how platforms and online merchants collect customer information, use behavioural data, conduct profiling, share information with third parties and demonstrate compliance with privacy requirements.

As digital commerce continues to expand, the NDPC’s initiative places consumer data protection and trust at the centre of Nigeria’s evolving e-commerce regulatory landscape.