Nigeria's legal framework offers only partial and indirect protection for data as an IP asset. The Copyright Act 2022, the country's modernized copyright statute, protects compilations of data — including data stored in a computer or any medium — as literary works where they show creativity or originality in selection or arrangement. However, Section 2(5) makes clear that copyright in a compilation confers no rights over the raw data it contains, and Section 3(a) expressly excludes 'mere data,' ideas, procedures, and processes from protection.
Nigeria has no dedicated trade secrets law and has not fully domesticated TRIPS Article 39, so confidential business data is protected mainly through common law principles and private arrangements such as NDAs and non-compete agreements — with no formal statutory penalties for trade secret theft beyond contractual remedies. There is likewise no sui generis database right; calls for such protection in sectors like fintech and healthtech have not produced concrete legislative proposals. Privity of contract further limits recourse against third-party misuse of data.
The Nigeria Data Protection Act 2023 governs personal data processing but does not extend to non-personal data or datasets as proprietary assets, leaving a recognized gap for data as a commodified resource. Supplementary protection comes from Section 37 of the 1999 Constitution, which guarantees privacy, and the Cybercrimes Act 2015, which criminalizes unauthorized access to computer systems and unauthorized access, interception and data interference, reaching intangible assets such as data. Data itself remains difficult to patent under the Patents and Designs Act 2004.
Key takeaways
- Copyright over compilations is the most prominent protection for databases in Nigeria, but it never reaches the underlying raw data.
- Without a trade secrets statute, NDAs and confidentiality agreements are the main safeguards, and remedies are limited to contract claims.
- The NDPA 2023 protects personal data only, leaving non-personal datasets without a proprietary protection regime.
- The Cybercrimes Act 2015 provides criminal backstops against unauthorized access and theft of intangible assets, including data.
- Privity of contract limits enforcement against third parties, so layered technical and contractual controls are advisable.
Primary legal instruments
AI-assisted summary of the report, editorially reviewed before publication · AI transparency
Protection mechanisms
Report-derived analysis per mechanism. The report text is fixed; committee members with contributor access can revise the rating (with an audit trail) and add notes below each block.
Recent Developments
Live updates contributed by committee members and the AI research bot — separate from the fixed report content above.
Federal High Court Affirms NDPC's Powers to Register Data Controllers and Processors
A Federal High Court recently confirmed the Nigeria Data Protection Commission's (NDPC) statutory authority to register data controllers and processors. This ruling reinforces the NDPC's role in enforcing data protection regulations across the country. The decision is expected to strengthen Nigeria's data governance framework, ensuring greater accountability and compliance within the digital economy.
NDPC Establishes AI Governance Benchmarks for Data Privacy in Automated Registries
The Nigeria Data Protection Commission (NDPC) outlined new AI governance benchmarks at the Corporate Affairs Commission (CAC) Annual Retreat. These guidelines mandate the extension of traditional data protection principles to AI training pipelines, requiring Data Protection Impact Assessments (DPIAs) for high-risk automated decision-making. The NDPC emphasized a multi-layered governance model, including human oversight, algorithmic auditability, and transparent controls, to protect citizens' rights in AI systems.
NDPC Outlines Data Sovereignty and Economic Value of Data Protection at UN General Assembly
At the 81st United Nations General Assembly, the National Commissioner/CEO of the NDPC presented a blueprint for data sovereignty, emphasizing its role alongside regulatory alignment and trust as catalysts for Africa's digital future. The address highlighted the strategic importance of using Africa's data for continental development and positioned data protection and privacy as essential economic infrastructure. This perspective underscores the inherent value and control of data, aligning with its treatment as a strategic asset.
Legal Analysis Highlights Gaps in Copyright Act for AI-Generated Content and Data Mining
A legal analysis examines Nigeria's National Intellectual Property Policy and Strategy 2025, pointing out deficiencies in the Copyright Act 2022 regarding artificial intelligence. The analysis notes the Act lacks comprehensive provisions for authorship, ownership, and infringement concerning AI-generated content. It suggests that existing copyright laws need to evolve to address challenges posed by AI, data mining, and digital licensing.
NITDA DG Outlines National Cloud First Policy for Digital Economy and Data Sovereignty
The Director General of the National Information Technology Development Agency (NITDA) emphasized the federal government's commitment to a private sector-driven digital economy. He highlighted that value creation in the digital age relies heavily on data, connectivity, and computing power, underscoring the need for national control over digital infrastructure. To address this, NITDA promotes a National Cloud First Policy, encouraging government and large organizations to prioritize cloud adoption for digital solutions. This policy aims to ensure adequate control over how data is collected, stored, processed, and governed within Nigeria.
Regulator Emphasizes Data Protection Imperative in Election Management Technologies
The Nigeria Data Protection Commission (NDPC) highlighted the critical role of data protection in election management technologies at a recent summit. The National Commissioner/CEO stressed that while technology improves efficiency, it also increases the volume of personal and biometric data, necessitating robust data governance. The NDPC is collaborating with the Independent National Electoral Commission (INEC) to ensure voter data is protected under the Nigeria Data Protection Act, 2023. This initiative aims to build public trust and confidence in democratic processes by securing sensitive electoral data.
NDPC Partners GIZ to Strengthen E-commerce Data Protection Compliance
The Nigeria Data Protection Commission (NDPC) collaborated with GIZ to host a validation workshop on a Data Privacy Framework for e-Commerce. This initiative aims to bolster sectoral compliance with the Nigeria Data Protection Act 2023. The workshop highlighted the importance of building trust in the digital marketplace and the repercussions of failing to adhere to data protection regulations.
NITDA DG Calls for Evolved Regulatory Frameworks for Digital Banking and Data Systems
The Director General of the National Information Technology Development Agency (NITDA) highlighted the inadequacy of traditional regulatory tools for modern banking. He advocated for a shift towards real-time supervision and a broader ecosystem approach, emphasizing that financial stability now depends on digital stability. This includes adapting regulations to encompass evolving data systems and emerging technologies within the financial sector.
Multi-Agency Technical Committee Inaugurated to Advance National Sovereign Cloud Implementation
The National Information Technology Development Agency (NITDA) and the Budget Office of the Federation have established a Joint Technical Committee for the National Sovereign Cloud Initiative. This committee will address fiscal, procurement, and investment aspects, with a focus on cybersecurity and data governance. The initiative aims to enhance efficiency, resilience, and optimize public sector digital infrastructure and data management.
NDPC and Governors' Forum Lead Sensitisation on Data Protection Act Implementation for State Governments
The Nigeria Data Protection Commission (NDPC), in collaboration with the Nigeria Governors’ Forum, conducted an implementation workshop for state government officials. This initiative aimed to sensitize Commissioners, Heads of Service, and Attorneys-General on the provisions of the Nigeria Data Protection Act, 2023, and its General Application and Implementation Directive. The workshop emphasized the critical role of state governments in fostering trust and compliance with national data protection policies.
Regulators Partner to Enhance Data Protection Compliance in Financial Sector
The Nigeria Data Protection Commission (NDPC) has partnered with the Securities and Exchange Commission (SEC) to ensure sector-wide compliance with the Nigeria Data Protection Act, 2023. This collaboration aims to strengthen the protection of investor data and promote adherence to data privacy principles within the financial sector. The NDPC urged the SEC to sensitize its staff and stakeholders on data protection, with both bodies exploring further cooperation to bolster data security.
NDPC extends first GAID-era Compliance Audit Return deadline to 30 May 2026 amid tightened audit enforcement
The Nigeria Data Protection Commission moved the filing deadline for 2025 Compliance Audit Returns from 31 March to 30 May 2026, in what is the first full audit cycle conducted under the General Application and Implementation Directive (GAID) 2025 that replaced the NDPR. Data controllers and processors of major importance must file through licensed Data Protection Compliance Organisations, and late filing attracts a 50% surcharge on the filing fee plus exposure to enforcement action. The Commission has signalled a stricter 2026 audit season, with sanctions of up to N10 million or 2% of annual gross revenue for non-compliant organisations.