In an era when personal information has become one of the most valuable assets in the digital economy, protecting data is no longer merely a regulatory requirement; it is a defining test of institutional responsibility, cybersecurity readiness and public trust. At the forefront of this critical mission is Victor Ita Ekpenyong, a data protection consultant, cybersecurity expert and digital trust advocate whose professional work is helping organisations translate compliance obligations into practical safeguards for information and technology.

With over seven years of experience spanning data protection, regulatory compliance, cybersecurity and professional training, Ekpenyong has built a career around helping organisations identify vulnerabilities, strengthen information governance and embrace responsible data management. As Team Lead at Floliz Nigeria Limited, an award-winning Data Protection Compliance Organisation recognised by the Nigeria Data Protection Commission (NDPC) as the Best Performing Data Protection Compliance Organisation in Nigeria, he is actively contributing to efforts to embed data protection into organisational culture, transforming it from a mere compliance obligation into a fundamental part of everyday operations, decision-making, and institutional accountability.

His experience cuts across financial institutions, government agencies, telecommunications companies, educational institutions and technology-driven enterprises. From nationwide data protection training initiatives involving MTN Nigeria to capacity-development programmes for National Youth Service Corps personnel and more than 850 staff and partners of the Nigeria Education Repository and Databank, his work reflects a commitment to building the knowledge and institutional capacity required to protect information in an increasingly interconnected world.

Beyond compliance audits, cybersecurity assessments and regulatory advisory, Ekpenyong champions a broader understanding of digital trust, one founded on accountability, technical preparedness, professional competence and respect for personal information. Through his work at Floliz and as host of the Digital Trust Podcast, he continues to advance conversations on data protection, emerging technologies, cybersecurity and the responsibilities that accompany digital transformation.

In this interview, he discusses the vision behind Floliz Nigeria Limited, the realities of implementing Nigeria’s data protection framework, the cybersecurity threats confronting organisations, and the practical measures institutions can adopt to protect sensitive information. He also shares his perspective on the future of digital trust in Nigeria and Africa, making a compelling case for why organisations must look beyond regulatory compliance to embrace a culture of sustained accountability and security…. Excerpt.

Floliz has positioned itself within Nigeria’s data protection and compliance space. What inspired its establishment, vision and mission?

Floliz was established to bridge the gap between regulatory expectations and practical implementation. As organisations embraced digital technologies, many lacked the expertise and structures to protect personal information effectively. Our vision is to become one of Africa’s most trusted data protection and cybersecurity advisory organisations. Our mission is to help institutions protect information, manage digital risks, meet regulatory obligations and build lasting trust through advisory services, technical assessments and professional training.

What key data protection and compliance challenges does Floliz address?

The central challenge is the difference between compliance on paper and compliance in practice. Some organisations have privacy policies but inadequate procedures, incomplete processing records, weak third-party oversight or limited management involvement. The Nigeria Data Protection Act, 2023, and General Application and Implementation Directive, 2025, provide a stronger framework, but effective implementation remains essential. We help organisations embed privacy into governance, daily operations, technology and employee practices.

What are Floliz’s core services?

We offer data protection audits, regulatory filings, Data controller and processor registration, Data Privacy Impact Assessments, policy development and outsourced DPO support. Our cybersecurity services include Vulnerability Assessment and Penetration Testing (VAPT), risk assessments and remediation guidance. We also provide governance and regulatory advisory, ISO management systems implementation and certification-readiness support, and professional training through NDPC-recognised programmes and our partnership with the Institute of Information Management (IIM) Africa.

 What makes Floliz different from other compliance firms?

We combine regulatory knowledge, technical cybersecurity expertise and practical capacity development. Floliz was recognised by the Nigeria Data Protection Commission (NDPC) as the Best Performing Data Protection Compliance Organisation in Nigeria. With over seven years of sector experience and more than 1000 compliance audits in our track record, we focus not simply on identifying gaps, but on helping clients correct them and sustain measurable improvements.

What are the company’s most significant achievements?

Our NDPC recognition is a defining milestone. We have conducted more than 1000 data protection compliance audits and delivered large-scale training for prominent institutions. These include nationwide data protection training for MTN Nigeria staff and partners, programmes for National Youth Service Corps (NYSC) personnel, and training for over 850 staff and partners of the Nigeria Education Repository and Databank (NERD). These engagements demonstrate our ability to deliver practical solutions at scale.

What common compliance gaps do you encounter, and how do you address them?

Recurring gaps include inadequate privacy notices, incomplete processing records, weak retention controls, missing DPIAs, insufficiently supported DPOs and poor breach-response arrangements. Some organisations mistakenly consider registration or annual filings sufficient. We assess existing controls, identify risks, develop prioritised remediation plans and support implementation, monitoring and staff training. Compliance must be a continuous organisational responsibility.

What are the biggest threats to personal data in Nigeria?

Major threats include phishing and social engineering, ransomware, vulnerable web applications, insecure databases, cloud misconfigurations, insider mistakes and third-party weaknesses. Artificial intelligence can also make impersonation more convincing and introduce new privacy risks. Often, preventable governance and security failures are as damaging as sophisticated attacks. Organisations need proactive assessments, prompt remediation, access controls, monitoring and incident preparedness.

How can organisations strengthen data protection and cybersecurity?

Leadership must treat privacy and cybersecurity as enterprise-wide responsibilities, not simply IT matters. Organisations should understand the data they hold, restrict access, oversee vendors and apply appropriate retention controls. Regular VAPT, multifactor authentication, patching, security monitoring and tested incident-response plans are essential. Equally important are role-specific training and management accountability. Effective protection depends on leadership, people, processes and technology working together.

What are Floliz’s priorities over the next three to five years?

We aim to expand professional training, deepen cybersecurity and digital risk capabilities, strengthen our work on AI and emerging technology governance, and explore technology-enabled compliance solutions. We will also grow our international management systems advisory services and pursue strategic partnerships across Africa. Our goal is to become a recognised African centre of excellence in data protection, cybersecurity and professional capacity development.

What message do you have for existing and prospective clients?

Trust is earned through accountability and demonstrated protection of information. We thank our existing clients for their confidence and remain committed to responsive, high-quality service. To prospective clients, our promise is practical expertise, measurable results and continuous support, not compliance documentation alone. Data protection and cybersecurity are investments in resilience, reputation and sustainable growth. At Floliz, compliance is not the ultimate destination. Trust is.