NDPR AND THE REQUIREMENT TO EMPLOY DATA PROTECTION OFFICERS.

NDPR AND THE REQUIREMENT TO EMPLOY DATA PROTECTION OFFICERS.

Part 4.1.2 of the Nigeria Data Protection Regulation (NDPR) provides that every data controller shall designate a data protection officer (DPO) to ensure adherence to the regulation, relevant data privacy instruments and data protection directives of the data controller. The data controller can have an internally sourced DPO or decide to outsource data protection responsibilities to a verifiably competent Data Protection Compliance Organization (DPCO).

The introduction of the DPO function establishes a new mandatory role for Nigerian data controllers. This requirement for DPO’s can also be seen in other data protection legislations such as the European General Data Protection Regulation 2018 (GDPR) Article 39 and the UK Data Protection Act 2018.

The recently published Nigerian Information Technology Development Agency  (NITDA) “Guidelines for the Management of personal data by public institution in Nigeria 2020” states that ‘Every public institution shall within 90 days of the issuance of this guideline, designate an official who shall act as the DPO for the institution. It makes it a requirement that such person must be a senior official reporting directly and independently to the management.[1] This requirement emphasizes the importance of DPO’s in every organizations and emphasizes the mandatory nature of the role.

It is therefore necessary that public institutions understand the need to act fast in securing the services of a DPO in order not to fall foul of the NDPR.

Having identified that a DPO is required, the next important step is to determine the type of job skills that a DPO should have to be able to fulfil the role.

A DPO:

• should be a person with expert knowledge of data protection and privacy law practices. They must have a strict legal perspective to meet data protection requirements both locally and internationally. DPO’s must know data protection law to a level of expertise based on the type of processing carried out by the controller.
• should have leadership and project management experience, to be able to request, direct, lead resources needed to carry out their roles.
• should have broad business experience to know the industries of the data controller well enough to understand how privacy should be implemented to integrate smoothly with the way each company designs and markets its products and services and earns its revenue.    
• should be able to speak in the language of the average Nigerian citizens, not technical and legal jargons.
• must have great communication skills to speak with a wide range of audience ranging from but limited to Board of Directors, data subjects, IT staffs and lawyers.
• should have substantial IT experience
• should have attained information security, and data protection certifications

Lastly, it will be best if the DPO’s are full time in their role to avoid conflict of interest with other functions in their organisation.

In the light of the above here are some of the tasks a DPO will be required to fulfil as part of their role:

• overlook and implement data protection and privacy compliance in an organization,
• function as an interpreter of data protection and privacy requirements for different business units.
• provide constant training and capacity development for staff, licensees, contractors and stakeholders on data protection and privacy
• lead in developing data protection and privacy related policies and procedures.
• assist in reviewing and updating data protection and privacy related contractual clauses agreements and schedules
• be involved in coordinating data protection breaches,
• review Data Protection Impact Assessments (DPIA’s),
• identify data protection and privacy risks
• maintain records of processing of personal data,
• review business cases for data protection requirements
• become a bridge between related disciplines such as Legal and Security, Data Protection, IT, Audit, Compliance, analyzing how the results of data protection schemes may impact the organization.

The decision lies with every organization to find these skills either in a single person or an organization to perform these functions.

Whilst a DPO may rely on the technical skills of others, they must be sufficiently capable in all areas to provide independent data protection and privacy advice and assessment.

Even though every organization can define their own DPO roles they need to ensure they are in compliance with the NDPR.

REFRENCES.

Nigeria Data Protection Regulation- 2019.

The Guidelines for the Management of personal data by public institution in Nigeria 2020.

The European General Data Protection Regulation 2018 (GDPR).

[1] Section 2.7 Guidelines for the Management of personal data by public institution in Nigeria 2020.