A Professional Assessment of Privacy Law Obligations for Nigerian Telecommunications Operators

Nigerian telecommunications operators process vast quantities of subscriber personal data including communications records, location data, biometric identifiers, and financial information, creating significant obligations under the Nigeria Data Protection Act 2023, the Cybercrimes Act 2015, and the Nigerian Communications Commission's Consumer Code of Practice. This study provides a professional assessment of data privacy compliance obligations specifically applicable to telecommunications operators in Nigeria. Structured interviews were conducted with data protection officers and legal compliance specialists from three major telecoms operators and five NDPC officials. Review of NDPC compliance assessments, NCC consumer complaint records, and operator privacy policies from 2022 to 2024 was also undertaken. Results indicate that subscriber consent management for secondary use of data is inadequate across all reviewed operators. Lawful data sharing arrangements with government security agencies lack procedural safeguards, creating rule of law concerns. Law enforcement disclosure requests lack consistent legal process standards. Cross-border data transfer provisions under the NDPA 2023 are not fully incorporated into operator data governance frameworks. The study concludes that telecommunications data privacy compliance in Nigeria requires a sector-specific regulatory guidance note from the NDPC-NCC joint regulatory committee. Recommendations include a Telecommunications Data Privacy Code of Practice, mandatory periodic data protection impact assessments for new data processing programmes, and an industry privacy certification scheme.

Keywords: data privacy, telecommunications, NDPA 2023, NCC, subscriber data protection