Data Protection: NDPC Trains DPCOs, Warns Against Sharp Practices

In a bid to deepen compliance culture within the Nigeria data processing ecosystem, the Nigeria Data Protection Commission (NDPC) has conducted a practical audit training for licensed Data Protection Compliance Organisations (DPCOs) in Abuja. The two-day training, held on November 10 -11, 2026 at the Nigerian Army Conference Centre and Suites (NACCAS),was organised by the commission in collaboration with Meta under the NDPC Initiative for Data Protection. While declaring the training open, NDPC National Commissioner and CEO, Dr Vincent Olatunji, said the DPCOs as licensed entities authorised to carry out data protection services on behalf of the commission,need adequate training and retraining to effectively discharge their duties in line with ethical best practices. According to him, the number of licensed DPCOs across Nigeria has expanded from an initial 17 to 367 organisations, a steady growth that reflects rising nationwide demand for data privacy auditing and compliance advisory. The NDPC helmsman urged the DPCOs to uphold utmost ethical standards as they act on behalf of the commission, warning against nonchalance and sharp practices to avoid penalties, adding that licenses will be revoked for submitting false or misleading compliance audit reports and inaccurate fillings. “As regulators, we have given part of our power to you to work for us , and you must do the work very well, and that is why this training will continue on a regular basis,” he said. Olatunji noted that the directive by President Bola Ahmed Tinubu and a July 27, 2026 circular from the Office of the Secretary to the Government of the Federation (OSGF, mandating all Ministries, Departments, and Agencies (MDAs) to comply fully with the Nigeria Data Protection Act (NDP Act), 2023, has opened new frontiers for the DPCOs in form of consulting opportunities. In her presentation, Ibukunoluwa Owa, Head of Regulations Unit at the NDPC, spoke on the DPCO ecosystem as a public-private partnership approach to privacy regulation. While explaining the DPCO code of conduct, OWa noted that limited manpower and resources to supervise data controllers and data processors necessitated the DPCO initiative, adding that Nigeria has over 220 million data subjects, and adopting a Public-Private Partnership(PPP) model was imperative to raise awareness and deepen the privacy culture across Nigeria. Thematic focus of the two-day training included Compliance Checklist Audit, Audit Governance and Documentation, Auditing Security and Technical Measures, Auditing Transfer and Third-Party Systems, Findings, Risk Rating and the Audit Report, among other topics. Some of the participants who spoke with newsmen on the sideline, expressed appreciation to NDPC and Meta for the training, describing it as a timely intervention in the discharge of their duties as DPCOs. Adefunke Makanjuola,Joan Consult Limited, said: “I learnt so much from this training.’ As DPCOs, there are so many things we were not doing so well before now, but with this training we are in a better position to do things seamlessly”. Also speaking, Adaeze Onu of ECAM Global Services Nig.Ltd, lauded NDPC for the opportunity, adding that “the event has been very insightful and quite practical because the facilitators have been great with the teaching”. “They have given us practical insight into how to properly ensure that organisations comply with the NDPA Act and also how to perform different kinds of tests,” she said. A facilitator, Timothy Ogele, said the DPCOs were the only authorised bodies to help the NDPC ensure compliance, and therefore needed periodic training. “There have been a lot of gaps in compliance audits, either due to lack of depth in terms of understanding what needs to be done right, or procedural defects. “This training will actually help the DPCOs to actually know what to do in terms of conducting compliance audits,” he said.