Data Governance in Nigeria’s Telecommunication Industry: The Journey So Far.

Nigeria’s telecommunication industry has emerged as a central pillar of the country’s economy, enabling connectivity, commerce, and innovation. With over 220 million active lines and internet penetration surpassing 70% (NCC, 2023; [1], the sector has become the primary driver of digital transformation in Africa’s largest economy. Data governance within this industry refers to the policies, processes, and technologies employed to ensure the availability, integrity, confidentiality, and accountability of the vast amounts of subscriber and operational data collected daily (DAMA, 2020). The rise of 5G networks, Internet of Things (IoT) devices, and cloud-based services has exponentially increased the data landscape, introducing new opportunities for analytics-driven decision-making but also raising profound concerns over privacy, security, and regulatory compliance [2].

Despite the significance of data governance, Nigeria’s context presents unique challenges such as weak institutional enforcement, fragmented regulatory mandates, low levels of consumer awareness of privacy rights, and infrastructural deficits [3,4]. The 2015 MTN fine for failing to deactivate improperly registered SIM cards highlighted the consequences of poor governance frameworks [5]. Since then, Nigeria has sought to align its governance policies with global best practices by enacting the Nigeria Data Protection Regulation [6] and, more recently, the Nigeria Data Protection Act establishing the Nigeria Data Protection Commission as the principal enforcer [7]. However, as studies indicate [8], over 60% of Nigerian telecom subscribers remain unaware of these protections, underscoring a pressing need for consumer education and effective oversight.

This study situates data governance within Nigeria’s telecom industry by contextualizing global principles in local realities and examining the evolution, regulatory architecture, current challenges, and future directions. It emphasizes the importance of harmonizing regulatory efforts, adopting emerging technologies for compliance monitoring, and fostering a culture of accountability among stakeholders [9,10]. The section thus lays the groundwork for understanding why robust data governance is indispensable to safeguarding consumer trust and sustaining the sector’s growth trajectory in an increasingly data-driven economy

Defining Data Governance

According to the Data Management Association (DAMA, 2020), data governance is the exercise of authority and control over data assets to ensure quality, security, and compliance. In the Nigerian telecom context, data governance encompasses:
• Regulatory compliance (e.g., NDPR, NDPA)
• Consumer privacy and consent management
• Data quality, interoperability, and secure storage
• Monitoring and responding to data breaches [6]

Pre-Liberalization Era: Landlines and NITEL

Before liberalization, Nigeria’s telecommunications sector was a state-run monopoly dominated by Nigerian Telecommunications Limited (NITEL), established in 1985 through a merger of the Post and Telecommunications Department and Nigerian External Telecommunications (NET) (National Bureau of Statistics, 2024). Telephone services were largely limited to landlines, with fewer than 500,000 working lines nationwide by the early 1990s, mostly concentrated in urban centers [3]. Access was expensive and unreliable, and the sector was characterized by poor infrastructure and inefficiency [5].

Liberalization and Entry of Mobile Operators

In 1992, the Nigerian Communications Commission (NCC) was created to regulate the industry and foster competition. The real transformation came in 2001 when the federal government issued GSM licenses to private operators, opening the market to competition (NCC, 2023). This ushered in MTN Nigeria as the first GSM operator, followed by Econet (later Vmobile, then Zain, then Airtel), Globacom (Glo) in 2003 as the first indigenous operator, and Etisalat in 2008 (rebranded as 9mobile in 2017) [10]. This period saw exponential subscriber growth, surpassing 100 million lines by 2012 [10].

Data Governance Challenges in the Liberal Era

While liberalization improved access, data governance lagged behind. SIM registration was introduced in 2010 to address rising security concerns, but enforcement was weak, leading to incidents like the MTN fine in 2015 for improperly registered lines [4]. These shortcomings highlighted the need for robust data policies.

Regulatory Maturity

Nigeria’s regulatory maturity has evolved significantly in the past decade, influenced by global data privacy standards and local pressures for accountability. The NDPR of 2019 (NITDA, 2019) [6] marked a paradigm shift by formally codifying data privacy principles, defining data subject rights, and imposing obligations on data controllers. While NDPR raised awareness, it faced criticism for lacking a dedicated enforcement body [3]. To address these gaps, the NDPA of 2023 established the Nigeria Data Protection Commission (NDPC) as an autonomous authority empowered to investigate breaches, levy penalties, and promote best practices (NDPC, 2023). This law aligns closely with international benchmarks such as the EU’s GDPR [9], reflecting Nigeria’s intent to harmonize with global norms while adapting to local realities. The NDPC has also launched guidelines on lawful processing, breach notification, and cross-border data transfers, signaling increasing sophistication in governance [10]. This regulatory evolution underscores a shift from reactive compliance to proactive governance, laying the foundation for a resilient, privacy-conscious telecom industry in Nigeria. These historical milestones-liberalization, SIM registration, MTN sanction, NDPR, and NDPA-reflect Nigeria’s evolving recognition of data as both an economic asset and a societal risk [10].

Nigeria’s telecommunication sector is governed by a complex web of regulatory and institutional frameworks designed to ensure compliance, protect consumer rights, and foster innovation. The primary institution is the Nigerian Communications Commission (NCC), established by the Nigerian Communications Act of 2003, which regulates licensing, spectrum allocation, SIM registration, and Quality of Service (QoS) (NCC, 2023). Complementing NCC is the National Information Technology Development Agency (NITDA), which issued the pioneering Nigeria Data Protection Regulation (NDPR) in 2019 to safeguard personal data (NITDA, 2019) [6]. The NDPR laid the foundation for the Nigeria Data Protection Act (NDPA) of 2023, which created the Nigeria Data Protection Commission (NDPC) as the primary enforcement authority with powers to investigate breaches, sanction violators, and issue compliance directives (NDPC, 2023).

Additionally, the Cybercrimes (Prohibition, Prevention, etc.) Act of 2015 criminalizes unauthorized access, hacking, and data interception, strengthening the legal framework for cybersecurity [4]. The Universal Service Provision Fund (USPF), created in 2007, focuses on bridging the rural-urban digital divide by funding connectivity in underserved areas (USPF, 2022). The National Identity Management Commission (NIMC) also plays a crucial role by managing biometric identity data used for SIM registration and verification [3].

Table 1: below summarizes the major regulatory and institutional frameworks.

Emerging Technologies

The rollout of 5G networks in major Nigerian cities such as Lagos, Abuja, and Port Harcourt is transforming the data landscape by enabling high-speed connectivity, low latency, and supporting data-intensive applications like IoT and smart cities [2]. However, 5G also brings heightened cybersecurity and privacy risks due to expanded attack surfaces and increased data collection points [3]. As IoT devices proliferate, weak authentication and inconsistent standards further compound vulnerabilities.

Digital Literacy Gaps

Despite regulatory advances, Nigerian consumers largely lack awareness of their data protection rights under NDPR and NDPA, with over 60% unfamiliar with how their personal data is collected, stored, and shared [8]. This lack of digital literacy leaves consumers unable to exercise their rights effectively or hold data controllers accountable, making them susceptible to exploitation and misuse of their personal data [10].

Enforcement Gaps

The NDPC, though empowered under NDPA, struggles with limited resources and personnel to enforce compliance uniformly across Nigeria’s large telecom market [4]. Overlapping mandates between NCC, NITDA, and NDPC sometimes create confusion and regulatory inefficiencies, allowing some operators to exploit loopholes or delay compliance with privacy standards [9].

Rural Data Governance

In rural and underserved areas, infrastructure gaps and lower regulatory oversight have allowed operators to cut corners on privacy best practices in favor of cost-saving measures [11]. This creates a digital divide not only in access but also in the level of protection afforded to subscriber data. Studies suggest rural subscribers are less likely to be informed of privacy policies and more vulnerable to data misuse [1]. These trends highlight the urgent need for Nigeria to strengthen its governance frameworks with targeted investments in consumer education, inter-agency collaboration, and technological tools to monitor compliance in real-time [5].

Nigeria’s telecom industry has begun adopting best practices to improve data governance and align with international standards. A notable case is MTN’s compliance reforms post-2015 fine, which included biometric SIM registration audits, data privacy training for staff, and establishing a dedicated data governance unit to prevent recurrence [5]. The Universal Service Provision Fund (USPF) exemplifies efforts to bridge the digital divide while integrating privacy safeguards into rural connectivity projects, although further monitoring is needed to ensure sustainable impact [11]. Another model is Novatia Consulting’s advisory framework, which recommends harmonizing compliance, security, and literacy to create a privacy-conscious corporate culture [10].

Table 2: below summarizes best practices observed in Nigerian telecoms.

These case studies demonstrate that while gaps remain, targeted investments, institutional learning, and stakeholder engagement can improve data stewardship and public trust [9,3].

Nigeria’s telecommunication industry must adopt forwardlooking strategies to build a resilient and trusted data governance ecosystem. First, framework harmonization is essential to eliminate regulatory overlaps among NCC, NITDA, and NDPC while clarifying roles and compliance pathways for operators [4]. Policymakers should consider establishing a central data governance coordination council to foster inter-agency collaboration [9]. Second, technology-driven oversight is vital. Emerging technologies like artificial intelligence, blockchain, and machine learning can enable automated breach detection, auditable consent management, and transparent reporting [10]. Deploying AI for pattern recognition can help regulators identify systemic risks more efficiently [2].

Third, capacity building is required to cultivate skilled professionals and institutional capabilities. Training programs and certifications in data governance, privacy law, and cybersecurity should be integrated into higher education curricula and corporate development plans [3]. Fourth, public education campaigns must bridge the awareness gap, informing citizens of their rights under NDPR and NDPA and providing clear channels for complaints and redress [8]. Multimedia campaigns, in local languages, can enhance outreach, particularly in rural areas [11]. Finally, regional integration should align Nigeria’s frameworks with the African Union’s Malabo Convention and other regional agreements to support cross-border data transfers and regional digital markets [9]. Collectively, these directions position Nigeria to lead by example in balancing innovation with privacy and security in Africa’s digital economy.

Nigeria’s telecommunications sector has demonstrated remarkable progress, transitioning from a monopolistic, underdeveloped system to one of Africa’s most vibrant and competitive markets. Yet, this progress has brought to the fore the urgent need for comprehensive, robust, and forward-looking data governance to safeguard privacy, foster trust, and support innovation [5,3]. The implementation of NDPR and NDPA alongside institutional strengthening through NDPC and NCC reflects Nigeria’s determination to align with global best practices such as the GDPR while addressing unique local realities [7,9].

This paper underscores that harmonized regulation, clear delineation of responsibilities, technological adoption, public awareness campaigns, and capacity building are critical pillars of a resilient governance framework [10]. Furthermore, embracing regional integration and cross-border data governance under initiatives like the AU Malabo Convention will help position Nigeria as a leader in Africa’s digital economy [9]. Ultimately, through sustained commitment and stakeholder collaboration, Nigeria can foster a privacy-conscious, innovation-driven telecommunications industry that ensures consumer trust, national security, and socioeconomic development in the digital age [4,11].

None.

No conflict of interest.

1. National Bureau of Statistics (2024) Nigeria telecommunications industry performance report. NBS.
2. Eze U, Musa R (2024) 5G adoption and data privacy in Nigeria. Nigerian Journal of ICT 15(1): 78-95.
3. Okoye P, Hassan M (2022) Data privacy in emerging economies: The Nigerian experience. Journal of African Law 66(2): 210-229.
4. Okonkwo I (2023) Institutional overlaps in Nigerian data protection regime. Regulatory Insights Africa 7(4): 56-69.
5. Adewale T (2018) Data governance failures in Nigeria: Lessons from the MTN case. African Journal of Telecommunications Policy 12(3): 145-162.
6. NITDA (2019) Nigeria Data Protection Regulation. National Information Technology Development Agency.
7. NDPC (2023) Nigeria Data Protection Act: An overview. Nigeria Data Protection Commission.
8. KPMG (2023) Nigerian consumer privacy awareness survey report. KPMG Nigeria.
9. Bouke MA (2023) AU convention on cyber security and data protection: Challenges & future directions.
10. Novatia Consulting (2024) Data governance advisory in Nigeria. Novatia Consulting Limited.
11. Universal Service Provision Fund (2022) Annual report on rural connectivity. USPF.