Experts: Boards, Executives Must Lead Data Protection Culture

Kayode Tokede

Business leaders, regulators, and governance experts at the KENNA Data Protection Dialogue have warned that the growing importance of data and data processing in business operations will create digital vulnerabilities unless boards and executives take proactive ownership of data protection obligations.

The event, held in Lagos, gathered regulators, executives, legal practitioners, and governance specialists to deliberate on the challenges and opportunities within Nigeria’s evolving data protection landscape.

Speakers stressed that compliance can no longer be treated as a back-office function but as a strategic priority championed at the highest levels of corporate governance.

In his address, KENNA’s Senior Partner, Professor Fabian Ajogwu, SAN, underscored that boards now have an even greater responsibility in shaping organisational culture by embedding sound data protection practices and providing effective governance direction.

He said: “Boards and management now serve as intermediaries between the company and its stakeholders, including regulators, and are responsible for providing governance and strategic oversight. They must embed data protection into corporate strategy and ensure it is clearly documented, communicating that it is just as important as financial performance in order to drive accountability.”

Delivering the keynote address, the National Commissioner/CEO of the Nigeria Data Protection Commission (NDPC), Dr. Vincent Olatunji, ably represented by the Head of the Commission’s regulations unit, Ibukunoluwa Owa, explained that the Nigeria Data Protection Act, 2023, is aligned with the view that data protection should be within the purview of senior management.

Owa remarked: “If you look at the NDP Act GAID, you will see that we specifically recommend that Data Protection Officers (DPOs) should be drawn from senior management. The reason is simply because DPOs are expected to act independently and provide unbiased advice on the compliance actions organisations must take. A junior or mid-level staff member may struggle to influence senior management on such critical issues. There is also a growing argument that the role should even be elevated to board level, given the significance of data protection. It is no longer a peripheral concern but a business imperative.”

On the reason why the embedding of data protection guidelines within organisations remains nascent and is not progressing at the projected rapid rate, Partner at KENNA, Nimma Jo-Madugu, attributed it to the caution and hesitation that often accompany new legislation.

Jo-Madugu stated, “We are witnessing a similar adoption curve with data protection as we once did with corporate governance. At the time, many viewed governance as little more than CSR, until it became clear that compliance was both mandatory and essential.”

General Manager of Commercial Legal & Intellectual Property at MTN Nigeria, Ifeoma Utah,commended the progress in the enforcement and adoption of data protection laws but urged the harmonisation of regulations across sectors for enhanced economic impact.