Data Privacy Management Practices in Nigerian Telecommunications Companies: A Survey of MTN and Airtel Operations in South East Nigeria

The enforcement of data privacy regulations in Nigeria, particularly under the Nigeria Data Protection Act 2023, has placed significant compliance obligations on telecommunications companies that process large volumes of subscriber personal data. This study surveys data privacy management practices in the South East Nigeria operations of two major telecommunications providers, MTN Nigeria and Airtel Nigeria, covering facilities in Enugu, Onitsha, and Owerri. A mixed-methods approach combining 80 staff questionnaires and 10 management interviews was employed to assess data handling practices, consent management processes, data breach response capabilities, customer rights fulfilment, and staff privacy training programmes. Findings indicate that both companies have implemented privacy policies and designated data protection officers as required by the Nigeria Data Protection Act, yet gaps persist in data subject access request response times and the comprehensiveness of data breach documentation. Staff at mid-management levels demonstrated moderate awareness of privacy obligations, while frontline customer service agents showed significantly lower compliance knowledge. The study proposes a Data Privacy Maturity Model for the Nigerian telecommunications context and benchmarks the two companies against its dimensions. Recommendations include quarterly staff privacy refresher training and integration of privacy impact assessments into product development cycles. Keywords: data privacy, Nigeria Data Protection Act, telecommunications, MTN, Airtel.