Vincent O. Olatunji, pioneer commissioner and chief executive officer of the Nigeria Data Protection Commission (NDPC), has led the country’s data protection agenda from the establishment of the Nigeria Data Protection Bureau in 2022 to the enactment of the Nigeria Data Protection Act in 2023. With more than 36 years of public-sector experience, he has overseen the development of the commission’s legal and institutional foundations, strengthened compliance and enforcement, and advanced Nigeria’s standing in global data governance. In this interview with Bashir Ibrahim Hassan, general manager (northern operations), BusinessDay, Olatunji reflects on the challenges of building the institution, the growing importance of data protection in a digital economy shaped by artificial intelligence, and the role of trust, accountability and responsible data use in Nigeria’s economic future. This is BusinessDay’s second interview with Olatunji, the first being a few weeks after he assumed office at the nascent organisation. Excerpts

What type of data does your organisation protect, as distinct from those of other organisations?

I think this is a relevant question. Many people are confused about the kind of data we are talking about. For instance, some mistake the kind of data we refer to for the data telecommunications companies sell for browsing the internet. There are socioeconomic data used for national planning, government policies and strategies. These are also data we use to benchmark ourselves against our peers.

However, the data we deal with are person-specific data, i.e. data that identify you as a natural person – your name, telephone number, national identification number, passport number, email address and home address. There is still a distinction between two data categories: publicly available personal data and sensitive personal data. The latter requires additional layers of security.

These are data that could be used to discriminate against someone. For instance, data about your religious background, private life, biometrics and medical history. There was once a case of someone who tested positive for HIV and, before they got home, the news was already all over the place. That is sensitive medical data that should never be made public.

We use our publicly available personal data in our everyday lives, including our social media handles and the online forms we fill in for social activities, sports and banking. Our lives revolve around data, and these are the kinds of data we protect. That kind of data is everything now because it is a strategic national asset.

As the pioneer chief executive officer of this great institution, tell us about your experiences running this organisation in the last three years.

We started a bureau without an enabling law or Act. We were using the Nigeria Data Protection Regulation (NDPR). Enforcing the regulation was challenging because it was not a national law passed by Parliament and signed by the President. It was a subsidiary regulation, and even at the global level, development partners would tell you that to be recognised as a data protection authority, you must have a national law.

And, like starting any new venture, we had teething problems such as funding, human capital development, awareness and getting people to understand what we were talking about. A lot of the things we do are intangible, unlike bricks, roads and other pieces of physical infrastructure.

If you told someone you wanted to protect their data and they asked, “What is my data?” and you responded, “Your name,” they would be taken aback. “A name I have carried for years and given to people. Why is there a sudden need to protect my name?” But data protection is much more than that. Identity theft is common these days and could lead to reputational damage and, in some extreme cases, death.

I must salute Mr President for providing support at the highest level. Without political will, enforcement of any law is challenging. We have overcome some of our initial challenges. This is why we are here today, making an impact in the lives of Nigerians and globally.

One of the first challenges you faced was finding office space, with zero funding and understaffing. How did you overcome these challenges, and how satisfied are you?

Initially, people did not believe in what we were doing. We were just running up and down, telling people what the future would be.

Now, we are the biggest data protection authority in the whole of Africa. In terms of funding, what we have in law is that the initial funding should come from either the Nigerian Communications Commission (NCC) or the Federal Government. We faced some challenges until the President intervened and gave us a take-off grant through which we were able to stabilise.

We are expected to be self-sustaining and, to the glory of God, this year we have started giving money back to the government. I know this will continue, and we will start supporting impactful initiatives from our fund.

What are your driving forces? Despite all the challenges, you stood your ground and kept moving the institution forward.

I have been fortunate to have good people around me. When things were tough, I got support from organisations, even outside Nigeria, including the World Bank and the European Union. Each time we made a case about what we were doing, we found organisations willing to support us.

Some organisations helped pay staff salaries in the past, and, in fact, the World Bank paid for our current office building. We demonstrate competence, and this has provided us with opportunities to enjoy tremendous support.

The world has moved beyond seeing data protection simply as privacy regulation. How do you see your role today, particularly as AI and digital platforms increasingly shape how economies work?

Data protection and data privacy are no longer a nice-to-have; they are a must-have. There are two critical things – one is value addition to whatever you are doing. Secondly, you must create trust. We hold data processors and controllers accountable for every piece of data they collect and process. You are held accountable by virtue of the law that we implement.

Now we are talking about artificial intelligence, which is taking over almost everything. In all the world’s efforts to innovate, maximise profit, take advantage of user economics and increase access to information, it is important that we think about the place of privacy and protecting the information of people whose data we use on a daily basis. This is about building trust.

At the global level, and in many fora, the conversation is about how to protect citizens’ rights to privacy while they use these technologies.

What has changed since the NDPA came into force?

Hitherto, you would see data controllers and data processors collecting and processing data in an unregulated manner, allowing unauthorised access to personal data and leading to many consequences. Now, they know there is a law and that there are ways they will be held accountable at every point in time. For instance, when we started, in the first year, in terms of audit filing and registration, we received 630. All organisations collecting personal data are supposed to register with us. We received 630 in the first year, and it has risen to 41,000 this year, within four years.

This number is still less than five per cent of the compliance we expect. There is still a big gap we have to bridge through awareness campaigns and capacity building. We want compliance to become a culture. We are going to schools and relevant institutions. We have issued fines and investigated organisations to sustain the mandate. There have also been presidential directives to this effect.

Trust is extremely important because almost every aspect of our lives is mobile and digital now. There are many organisations that you have to go online to interact with. For instance, with the Corporate Affairs Commission (CAC), you do everything online. This is the same for us and even the Nigeria Immigration Service. The era of people having more than one passport is gone.

We now have a foundational national identity structure that many other social amenities can build on; JAMB registrations happen online, and our parents in the village receive bank alerts and use point-of-sale (POS) machines. This makes data protection even more important. We all have to be conscious of protecting our data at all times. The general consensus among business operators is that regulators come to stifle innovation and business. But our case is different. We bring value to businesses because we help them build trust.

When you are compliant, people trust you and believe their data is protected with you. They are not afraid that their data will end up in the hands of a third party, who may then start sending unsolicited adverts. These issues can be reported to the NDPC.

Globally, AI is changing the data landscape quickly, with automated decision-making, surveillance, biometric data and the use of personal data to train AI systems. What should Nigerians be thinking about now, before these issues become challenges?

Well, one, there is no escape from them. We have to adapt. We have to deploy. There is something called responsible use of data. Whatever data you use in training AI must be handled responsibly and in accordance with the law.

In Nigeria, we plan to regulate the use of AI and any other emerging technology you want to talk about to ensure that people’s rights are protected in data collection. This is why we tell solution providers to ensure they deploy data modules that recognise citizens’ rights to data protection under the law.

Three years from now, what would you like to see happening differently in the way Nigeria collects, processes, protects, governs and uses data? What must governments, businesses, organisations and citizens do now to get there?

I have a vision in which people will come to us to hire data and privacy protection experts. So, awareness, human capital, feeling safe in Nigeria, trust, confidence and value. These are the things.

What kind of mechanisms and systems are you putting in place to sustain the successes recorded so far?

The way to achieve this is by putting a proper structure in place that carries everyone along in decision-making so that they start to see themselves as people whose opinions matter and as future leaders. Teamwork is absolutely important. We have a common vision, and everyone is on the same page.

What advice would you give a CEO starting out the way you did, with no office and little or no funding?

I think my first advice would be to tell them to understand the ecosystem. When we started this process, I told myself that, to lead a team, I needed to understand what they were doing. I started reading and also went for certifications. This has paid off because I am one of the most sought-after data protection experts in the world.

What would you consider your toughest challenge in doing this job?

It was getting people to understand what we were doing. It was a struggle to explain our work to people, some of whom would insult you, and even your staff might not understand the direction. But today, people can see and believe in what we are doing.

How do you measure the economic impact of the work of your Commission?

We have developed a roadmap, and what we do periodically is check the milestones. We have a five-year roadmap, which we review regularly to ensure we are doing what we have agreed to do and to identify where there are challenges.

In terms of direct economic impact, we have created an economy around data privacy. We adopted a public-private partnership (PPP) approach to implementing the law. We started licensing data protection compliance organisations. We experimented with 17, and now we have 362 licensed data protection officers who carry out compliance as a service. We have created an economy worth over US$12 billion around data privacy in Nigeria.

In terms of international recognition, we are one of the progressive countries in data privacy. Last year, 17 different countries visited us to learn from our model. At the level of the Global Privacy Assembly, we are recognised as one of the significant players. At the African level, through the Network of African Data Protection Authorities (NADPA), we punch above our weight.

In terms of foreign investors, we receive requests to verify the compliance status of some organisations. We have the law, and we have a body enforcing the law. This provides comfort. Foreign investors now feel comfortable in Nigeria because data processors and controllers are held accountable through what we are doing.