Businesses urged to make data protection part of daily operations

Nigerian businesses have been urged to strengthen their everyday data protection practices as the increasing use of digital platforms exposes customers, employees and other members of the public to growing risks associated with the handling of personal information.

Technology entrepreneur, Abraham Esandayinze Tanta, said organisations should move beyond treating data protection as a compliance exercise that receives attention only during audits or after a security breach.

He said businesses needed to make the protection of personal information an integral part of their daily operations, particularly as Nigerians increasingly rely on digital platforms for banking, education, employment, shopping and business transactions.

According to him, personal information provided by individuals quickly becomes part of an organisation’s records and must therefore be handled responsibly.

“It starts with a person. Then their information becomes part of your business. A name becomes an account. An account becomes a record,” Tanta said.

He noted that organisations routinely collect information such as names, telephone numbers, identification documents, financial details and other sensitive records through school registration portals, job applications, fintech platforms, merchant accounts and other digital services.

Tanta warned that poor management of such information could expose individuals to unwanted communications, fraudulent activities and other forms of misuse.

The Nigeria Data Protection Act (NDPA) places obligations on organisations that collect and process personal data, requiring them to put appropriate measures in place to protect information and respect the rights of data subjects.

However, Tanta said a gap could exist between privacy policies published by organisations and the evidence available to demonstrate that those policies were being implemented.

He said businesses should be able to show what personal information they hold, how it is processed, who has access to it and what measures are in place to protect it.

It was against this backdrop that Asiri, a data protection technology platform developed in Lagos by Tanta, was established to help organisations organise their data protection activities and maintain evidence of their compliance processes.

The platform provides tools for maintaining privacy records, managing requests from individuals, documenting incidents and organising evidence that organisations and their compliance advisers can review.

One of its features, Eri, enables users to ask questions about an organisation’s privacy position and identify records supporting the information provided.

The company, however, clarified that the platform is not designed to replace lawyers, Data Protection Officers (DPOs) or other professionals responsible for providing regulatory and legal advice.

Tanta said data protection needed to become an operational function rather than remaining largely a documentation exercise.

“Data protection has to become operational. Businesses need systems that help them know what they have, what they have done and what evidence exists to support their claims,” he said.

Asiri also provides a platform through which organisations can work with licensed Data Protection Compliance Organisations (DPCOs) and DPOs.

The company stressed that it is not itself a licensed DPCO and does not file regulatory returns on behalf of organisations. Such responsibilities, it said, remain with the appropriate professionals and officers.

The growing emphasis on data protection comes as Nigeria’s digital economy continues to expand, increasing the volume of personal information generated through everyday transactions.

For individuals, the issue extends beyond the existence of privacy policies or compliance documents. Customers increasingly want to understand who has access to their information, how it is being used and whether organisations can account for their data when problems occur.

Tanta said businesses should therefore focus on developing a culture of accountability in which they can demonstrate how personal information is collected, processed, stored and protected.

He said having a privacy policy should not be regarded as sufficient evidence of responsible data management if an organisation cannot demonstrate how the policy is being implemented.

Asiri’s approach reflects the growing emphasis on practical data protection measures, with organisations increasingly expected to demonstrate not only that policies and procedures exist but also that they are being implemented and supported by verifiable records.

The development highlights the need for businesses operating in Nigeria’s expanding digital environment to incorporate data protection into their routine operations while ensuring that the rights and privacy of individuals remain protected.