Business leaders, regulators, and governance experts at the KENNA Data Protection Dialogue have warned that the growing importance of data and data processing in business operations will create digital vulnerabilities unless boards and executives take proactive ownership of data protection obligations.
The event, held in Lagos on September 18, 2025, gathered regulators, executives, legal practitioners, and governance specialists to deliberate on the challenges and opportunities within Nigeria’s evolving data protection landscape.
The dialogue also served as the official launch of the book, Legal & Regulatory Aspects of Data Protection, authored by KENNA, which provides practical guidance on navigating compliance frameworks and strengthening organisational resilience in a data-driven economy.
The speakers stressed that compliance could no longer be treated as a back-office function but as a strategic priority championed at the highest levels of corporate governance. The dialogue underscored that the boardroom must set the tone for compliance, while executives drive execution across business operations.
In his address, KENNA’s Senior Partner, Prof. Fabian Ajogwu (SAN), underscored that boards now have an even greater responsibility in shaping organisational culture by embedding sound data protection practices and providing effective governance direction.
Ajogwu noted that data is now the backbone of strategic decision-making, innovation, and competitiveness; hence, it is pertinent that boards rise beyond mere compliance to actively champion policies, frameworks, and oversight that safeguard data and aid growth.
He said: “Boards and management now serve as intermediaries between the company and its stakeholders, including regulators, and are responsible for providing governance and strategic oversight. They must embed data protection into corporate strategy and ensure it is clearly documented, communicating that it is just as important as financial performance in order to drive accountability. Boards must also ensure technological expertise is reflected in their skills matrix, as it is only a matter of time before regulators mandate such representation.”
He added that data protection has to be seen as a strategic priority with clear oversight, and that transparency is an ethical obligation, while non-compliance carries direct consequences for an organisation’s bottom line.
In his keynote address, National Commissioner/CEO of the Nigeria Data Protection Commission, Dr Vincent Olatunji, represented by the Head of the Commission’s regulations unit, Ibukunoluwa Owa, said that the Data Protection Act, 2023, is aligned with the view that data protection should be within the purview of senior management.
Owa remarked: “If you look at the NDP Act GAID, you will see that we specifically recommend that Data Protection Officers (DPOs) should be drawn from senior management. The reason is simply because DPOs are expected to act independently and provide unbiased advice on the compliance actions organisations must take. A junior or mid-level staff member may struggle to influence senior management on such critical issues. There is also a growing argument that the role should even be elevated to board level, given the significance of data protection. It is no longer a peripheral concern but a business imperative.”
The dialogue featured a high-level panel discussion, comprising multi-sectoral experts, moderated by KENNA’s Associate, Chidera Ezenwanne. However, on the reason why the embedding of data protection guidelines within organisations remains nascent and is not progressing at the projected rapid rate, Partner at KENNA, Nimma Jo-Madugu, attributed it to the caution and hesitation that often accompany new legislation.
Jo-Madugu stated, “We are witnessing a similar adoption curve with data protection as we once did with corporate governance. At the time, many viewed governance as little more than CSR, until it became clear that compliance was both mandatory and essential. The same applies now with data protection. While the NDP Act is clear, organisations are still struggling with the extent of their obligations. Ultimately, once enforcement begins to carry financial consequences, the gravity of compliance will become undeniable.”
Building on this perspective, General Manager of Commercial Legal & Intellectual Property at MTN Nigeria, Ifeoma Utah,commended the progress in the enforcement and adoption of data protection laws, but urged the harmonisation of regulations across sectors for enhanced economic impact.
According to Utah, “We are moving in the right direction and making considerable progress, but the issue of multiple regulators remains critical. Different regulators often operate in silos, unaware of the compliance steps already undertaken with the Nigeria Data Protection Commission. This fragmentation creates uncertainty and can discourage investment. What we need is greater harmonisation; whether through collaboration, co-creation, or a handshake between regulators, in order to provide clarity and confidence for businesses.”
The Deputy Vice Chancellor (Admin) of the Pan-Atlantic University, Dr. Peter Bamkole, while acknowledging the steps taken by the NDPC in protecting the rights of citizens, urged greater focus on government agencies and bodies that are often found in contravention of data protection regulations.
Bamkole maintained: “While efforts to regulate the private sector are commendable, I believe the NDPC must begin by holding government agencies accountable. Many of these agencies collect excessive personal information without adequate safeguards, leaving sensitive data exposed and easily accessible. From drivers’ licences to other official records, citizens are often compelled to provide far more details than necessary, with little assurance that their data will be properly protected.”
Ezenwanne remarked that the importance of the dialogue came at a very critical time, given that the NDP Act GAID issued in March 2025 becomes effective on September 19, 2025, just a day after the dialogue.
The Dialogue hosted an array of guests from across sectors, with executives from Stanbic IBTC, Flutterwave, Cardinal Stone, United Capital Plc,Antan Producing Limited, FCMB, Seplat Energy, ExxonMobil, Quantum Zenith, Airtel, and Moneda Invest in attendance, among others.
