A New Headquarters, A Grassroots Imperative: The Case For A Decentralised Data Protection Structure in Nigeria -By Michael M. Arinze
Michael Arinze
INTRODUCTION
On September 14, 2026, Nigeria commissioned the new headquarters of the Nigeria Data Protection Commission (NDPC) in Abuja. The facility is a significant investment in Nigeria’s data protection institutional infrastructure. The investment comes at a time of rapid digitalisation, with government services, financial technology, artificial intelligence and data-driven commerce generating unprecedented volumes of personal data. The NDPC’s mandate, however, extends far beyond Abuja. Personal data is collected and processed daily across Nigeria’s States and Local Government Areas by public institutions, businesses, schools, hospitals and other organisations.
CONTINUE READING THIS ARTICLE BELOW AFTER THESE IMPORTANT NOTICES
Log in to primsol.lawpavilion.com and store.lawpavilion.com to enjoy the best E-journals, textbooks, and many more. For further enquiries/assistance, send an email to customercare@lawpavilion.com or call 08050298729
Effective protection therefore requires not only a strong national regulator, but meaningful regulatory presence closer to the people and institutions it regulates. Against this background, this article makes the case for a decentralised data protection structure in Nigeria. It examines the limitations of a predominantly centralised regulatory presence, the benefits of regulator proximity for awareness, compliance, and enforcement, and comparative approaches in other jurisdictions. It proposes a layered framework through which the NDPC can preserve a coherent national mandate while extending its reach through regional, state and grassroots structures.
THE STATUS QUO: A NATIONAL RIGHT ADMINISTERED FROM THE CENTER
The Nigeria Data Protection Act 2023 (NDPA) establishes the NDPC as the principal institution responsible for regulating the processing of personal data in Nigeria and protecting the rights and interests of data subjects. Its functions extend beyond enforcement. The Commission is required, among other things, to promote public awareness, educate the public on data protection, monitor compliance, receive complaints and advise government on data protection policies.
Significantly, however, the NDPA does not require the Commission to operate exclusively from Abuja. Section 4(3)(b) expressly provides that, although the Commission’s head office shall be in the Federal Capital Territory, it may maintain other offices in any part of Nigeria for the purpose of achieving its objects.
This provision is important because it demonstrates that geographical expansion aligns with the existing statutory framework. The Act has already contemplated institutional presence beyond the headquarters.
Nigeria has millions of data subjects spread across 36 States and the Federal Capital Territory. Personal data is collected in hospitals, schools, banks, telecommunications outlets, government ministries, universities, hotels, businesses and local government institutions. Many of these entities operate far from Abuja and outside the compliance ecosystems of large corporations.
For citizens whose medical records are disclosed without justification in Sokoto, whose biometric information is improperly collected in Enugu, whose personal details are repeatedly used for unsolicited marketing in Akure, or whose requests for access or rectification are ignored in Calabar, they are not concerned about whether the NDPC has a headquarters, they are more concerned about whether the regulatory system is close, accessible, intelligible and responsive to them and every Nigerian.
WHY DECENTRALISATION MATTERS
The case for decentralisation is a case for the effective enjoyment of data protection rights. Among others, decentralisation matters for the following reasons;
First, awareness. A right unknown to its holder is difficult to exercise. A 2025 survey of undergraduates at some universities found that 57 per cent did not know Nigeria had a data protection law, while only 48 per cent correctly identified the NDPA 2023. Despite over 60 per cent reporting data breaches or misuse, only 12 per cent had reported such incidents. The survey results could have been worse if it was conducted on people on the street, but the findings reinforce the need for sustained, geographically distributed data protection awareness.
State and regional structures could conduct sustained public education in local communities, universities, markets, schools, hospitals and public institutions. Data protection would become something encountered in ordinary civic life rather than principally through corporate privacy notices and professional conferences.
Second, enforcement. The proximity of the Regulators can improve the detection and escalation of unlawful processing. Local institutions are often better positioned to identify recurring practices within their jurisdictions and provide intelligence to a central enforcement authority.
Decentralisation need not dilute the NDPC’s enforcement powers; it can increase the Commission’s regulatory visibility.
Third, compliance. The regulatory burden is not experienced only by multinational corporations. Small businesses, schools, clinics, hotels, professional practices and local public authorities also process personal data, but may lack access to sophisticated privacy counsel. Regional compliance desks could provide guidance before non-compliance becomes an enforcement matter.
Fourth, access to remedies. The NDPA gives data subjects substantive rights and avenues for redress. A regulatory architecture that brings information, complaint assistance and basic guidance closer to citizens can reduce the practical distance between the existence of a right and its exercise.
Finally, decentralisation would strengthen government accountability. Government itself is a major processor of personal data. State and local institutions routinely handle information relating to identity, health, education, taxation, employment and social services. Regulatory proximity could therefore improve public-sector compliance as much as private-sector compliance.
COMPARATIVE PERSPECTIVES: WHAT OTHER SYSTEMS REVEAL
International experience demonstrates that geographical distribution of data protection supervision is neither novel nor incompatible with strong national regulation.
Kenya offers perhaps the most immediately relevant African example. The Office of the Data Protection Commissioner (ODPC) has pursued regionalisation of its operations, including 11 regional offices outside Nairobi where the head office is located. Its mandate expressly includes establishing legal and institutional mechanisms for protecting personal data and providing data subjects with rights and remedies. The Kenyan approach illustrates that decentralisation can be used to bring regulatory services closer to citizens without abandoning a unified national framework.
Germany provides an even more developed example of multi-level supervision. Rather than relying upon a single central data protection authority, Germany has supervisory authorities operating at the level of each of its sixteen Länder, alongside the Federal Commissioner for Data Protection and Freedom of Information, whose jurisdiction covers specified federal institutions and sectors. These authorities coordinate through the Data Protection Conference (Datenschutzkonferenz), which brings together the independent federal and Länder supervisory authorities. Germany’s constitutional structure differs substantially from Nigeria’s, and its model cannot simply be transplanted. Nonetheless, its experience shows that institutional diversity and regulatory consistency can coexist.
The lesson for Nigeria is therefore not to replicate foreign structures mechanically, but to identify that effective regulation often requires proximity to the regulated environment and the people whose rights are being protected.
TOWARDS A NIGERIAN MODEL OF REGULATORY PROXIMITY
Nigeria can develop a decentralised architecture without creating competing state data protection regulators. The first layer should remain the NDPC headquarters in Abuja, responsible for national policy, major investigations, international cooperation, standards, guidance and strategic enforcement. The second could comprise regional offices, strategically located to serve clusters of States. Their functions could include investigations, stakeholder engagement, compliance assistance, training and coordination of complaints. The third layer should consist of State Data Protection Desks or Focal Offices, potentially integrated into existing public infrastructure to reduce cost. These offices could serve as points of contact between the NDPC, State Governments, businesses, civil society and data subjects. The fourth layer should be community-level outreach, conducted through periodic clinics and partnerships with universities, hospitals, professional associations, business groups and civil-society organisations. Local Government Areas could designate data protection liaison personnel, particularly where public institutions process significant volumes of personal information.
Technology should complement and not replace this physical architecture. Digital complaint portals, automated guidance and remote hearings can extend the Commission’s reach, but they cannot completely substitute for institutional presence in a country where digital literacy, connectivity and access remain uneven.
Such a model would also permit the NDPC to gather better regulatory intelligence. Instead of waiting for violations to arrive at headquarters, the regulator would develop channels through which emerging risks are identified earlier and addressed closer to their source.
CONCLUSION
The commissioning of the NDPC’s new headquarters marks an important milestone in Nigeria’s data protection architecture. Its significance should, however, extend beyond Abuja. Effective regulation depends on the capacity to reach the people and organisations whose activities generate and depend upon personal data. The legal basis for this expansion already exists. Section 4(3)(b) of the Nigeria Data Protection Act 2023 expressly permits the Commission to maintain offices in any part of Nigeria for the attainment of its objectives. Nigeria should therefore build on this foundation by developing a decentralised structure comprising regional and state-level presence, supported by sustained grassroots engagement. Such a framework would strengthen awareness, compliance, enforcement and access to remedies while preserving the NDPC’s national regulatory mandate. The new headquarters should consequently serve not as the endpoint of institutional development, but as a foundation for extending data protection across Nigeria. Data protection should be national in mandate, but equally national in reach.
-  Kevin Namunwa, ‘Nigeria Commissions New NDPC Headquarters’ CIO Africa (15 September 2026) , Available at https://cioafrica.co/nigeria-commissions-new-ndpc-headquarters/ accessed September 16, 2026.
-  Nigeria Data Protection Act 2023, ss 4 – 6.
- Â Nigeria Data Protection Act 2023, s 5.
- Nigeria Data Protection Act 2023, s 4(3)(b).
- Akinjide Adebowale, ‘Survey: 57% Undergraduates Ignorant of Nigeria’s Data Privacy Law’ Foundation for Investigative Journalism (23 December 2025) https://fij.ng/article/survey-57-undergraduates-ignorant-of-nigerias-data-privacy-law/  accessed September 15, 2026.
-  Nigeria Data Protection Act 2023, ss 33 – 38, 46.
-  Office of the Data Protection Commissioner (Kenya), ‘Contact us’ Available at https://www.odpc.go.ke/contact-us/ accessed September 16, 2026.
-  Office of the Data Protection Commissioner (Kenya), ‘Who We Are’ https://www.odpc.go.ke/who-we-are/ accessed 16 September 2026.
-  DLA Piper, ‘Data Protection Laws of the World: Germany’ (2026) Available at https://www.dlapiperdataprotection.com/index.html  accessed September 15, 2026.
- Datenschutzkonferenz, ‘Die Datenschutzaufsichtsbehörden’ https://www.datenschutzkonferenz-online.de/datenschutzaufsichtsbehoerden.html?  accessed September 16, 2026.
- Â Nigeria Data Protection Act 2023, s 4(3)(b).
FOR SUPPORT TO BARRISTERNG BLOG, DONATE TO: 1. NAIRA ACCOUNT: 1023046978 - UBA Â 2. USD ACCOUNT: 5090743566 - FIDELITY BANK PLC
Call Bridget Edokwe Esq on 08060798767 or send your articles to barristerngblog@gmail.com
A Must-Have for Every Lawyer: Order Justice Alaba Omolaye-Ajileye’s Latest Books on Electronic Evidence Today: To order your copies, click the link below and order directly from the author:
https://velvety-cendol-7387ed.netlify.app/
SHOP NOW
The Price is 10k for Hard Copy less freight and 5k for E- Book copy in the Store of the Website. https://buokorie.com/store/ To access the hard copy, Call - 07087622283
