The Nigeria Data Protection Commission, NDPC, has issued a Code of Conduct for Data Protection Compliance Organizations, DPCOs, in the country.
This is ahead of its enforcement drive in 2024 and in a bid to ensure professionalism among firms that are licensed to carry out compliance as a service,
Whilst addressing the meeting of the Commission with the DPCOs, the National Commissioner, Dr Vincent Olatunji, urged DPCOs to see their role in the implementation of the Nigeria Data Protection Act (NDPA) 2023 as a public trust which must be guarded with the utmost sense of responsibility.
Olatunji noted the opportunities presented by the Act, particularly the lawful use of data and job creation in the data processing value chain.
Recall that NDPA 2023, under section 33, vests the Commission with the power to license persons with a requisite level of expertise in data protection and the Act to monitor, audit and report on compliance by data controllers and data processors.
This is a unique public-private partnership model designed to promote trust and confidence in Nigeria’s digital economy, which thrives on data processing like other economies around the world.
In line with the Code of Conduct, the compliance services that may be offered by DPCOs include but are not limited to the following: Awareness and capacity building?, Registration of the data controller or a data processor with the Commission, Development of compliance schedules;
d)Implementation of compliance schedules, NDPA Compliance Audit and filing of Compliance Audit Returns with the Commission; Data Privacy Impact Assessment; and Facilitating and Vetting Data Privacy Agreement.
The Commission noted that for a firm to operate as a DPCO and carry out compliance services, it must, among others, be duly licensed by the Commission and have a verifiably certified Data Protection Officer.
As of November 2023, 163 DPCOs have been licensed by the Commission.