Every State Government Holds Your Data. Most Have No Rules For It.
Abuja · Friday 21 August 2026
The Nigeria Data Protection Commission has signed separate agreements with the Nigeria Governors' Forum and the Bureau of Public Procurement, aimed at getting data protection rules actually operating inside state governments. A capacity building workshop for state officials has been running this month.
The Nigeria Data Protection Act has been law since 2023. The reason there is a workshop in 2026 explaining how to implement it is that, in most states, nobody has.
What state governments actually hold about you
The conversation about data privacy in Nigeria is dominated by banks and by lending apps, for understandable reasons. The more consequential holder of Nigerian personal data is government, and specifically state government.
| State system | What it holds |
|---|---|
| Vehicle registration and licensing | Name, address, biometrics, vehicle |
| Health facilities | Medical records, next of kin |
| School enrolment | Children's names, ages, guardians, addresses |
| Social registers | Household income, bank details, dependants |
| Internal revenue services | Income, employer, property |
| Residency and identity schemes | Biometrics, photographs, addresses |
Six systems most Nigerian states operate. Very few have a published retention policy for any of them.
Every one of those has been digitised somewhere in Nigeria in the last decade, frequently by a contractor, frequently with no published rule about how long the data is kept, who inside the state can query it, or what happens to it when the contract ends.
Why the procurement agreement is the clever part
The agreement with the Bureau of Public Procurement is the one most likely to change behaviour, and it is the one getting the least attention.
Data protection obligations are almost impossible to retrofit onto a system that has already been built. The point of leverage is procurement. If a state cannot award a contract for a health records platform or a residency card scheme without data protection requirements written into the tender, then compliance arrives with the system rather than years later as a remediation project nobody funds.
Regulators normally arrive after the damage. Putting the rule in the tender document is how you arrive before it.
The revenue angle, and why it cuts both ways
Data protection enforcement in Nigeria has generated substantial federal revenue since the reforms, in the region of N16.2 billion. That figure gets cited as evidence the regime is working.
It is worth being careful with it. A regulator that raises significant revenue from penalties has an incentive structure that needs watching, particularly when the entities easiest to fine are private companies with assets in Nigeria rather than state governments, which are considerably harder to sanction.
That asymmetry is the thing to watch as this rolls out. If enforcement continues to fall predominantly on banks, fintechs and telecoms while state ministries operate unaudited, the regime protects Nigerians from companies and not from the government. Companies are not the primary risk here.
Why business should care specifically
There is a straightforwardly commercial case, and the Governors' Forum has been making it: states that cannot demonstrate data governance struggle to attract the kind of investment that involves handling customer information.
That is real. A company deciding where to place a service centre, a data facility or a digital operation is looking at whether the jurisdiction has a functioning framework. Thirty-six states with thirty-six approaches, most of them undocumented, is a barrier that does not show up in an investment brochure but shows up in due diligence.
Standardisation across states is therefore worth more than the sum of the individual compliance improvements. A common platform means a company can assess Nigeria once rather than assessing Kano, Rivers and Lagos separately.
Whether it will happen
The workshop has brought together heads of service, attorneys-general and ICT commissioners from state governments, which is the correct group. Those three roles between them control whether a state actually adopts anything.
The honest prediction is uneven adoption. Lagos, Kaduna, Ekiti and one or two others with functioning digital teams will implement something recognisable. A larger number will appoint a data protection officer, publish a policy document, and change nothing about how the systems operate.
That is still progress from a standing start, and it is measurable. The test in twelve months is simple enough for any Nigerian to apply: pick a state, and see whether you can find out, in writing, what it does with your information. Today, in most of them, you cannot.
Reporting: Nigeria Data Protection Commission, Vanguard, The Sun Nigeria and Business Post Nigeria.
Read next
- Headline Inflation Is Falling. Food Inflation Has Risen Six Months Straight.
- Nigeria Is 62nd In The World, And Growing Faster Than Anyone
- Kenya Just Put A Government Stamp On A Nigerian Woman's Modelling Project
Sending money home is one thing. Sending something they can actually open is another. The Send Home boxes run from a full food shop to a digital learning kit. Naira pricing here.
