Consider Mama Ngozi. Every month, she visits a state healthcare clinic in Umuahia to manage her chronic health conditions. At the front desk, a health worker inputs her sensitive medical history, home address, and telephone number into a newly deployed digital health portal.
A few miles away, her son, a young schoolteacher, registers his tax details on the state’s digital revenue portal to ensure his salary is processed seamlessly. Meanwhile, her teenage granddaughter accesses an e-learning platform rolled out across public schools.
To the average family, these digital transformations represent progress, speed, and modern governance. But behind every digital form filled, every biometric scan captured, and every record uploaded lies an unseen trail of personal, sensitive data.
What happens if that data falls into the wrong hands? What protects Mama Ngozi’s medical confidentiality, her son’s financial records, or her granddaughter’s digital footprint?
In an era where data has become a strategic currency, state governments across Nigeria have emerged as some of the largest collectors of personal information. From tax clearance portals and civil service registries to health records and public-school enrolment, public institutions handle millions of citizens’ personal details daily. Yet, across much of the public sector, the conversation surrounding privacy and data protection has often been relegated to an afterthought – a technical detail left to IT departments, or a legal hurdle addressed only after a high-profile breach or regulatory penalty.
A shift in this mindset, however, is beginning to take root.
Recently, the Abia State Government took a decisive, proactive step to rewrite this narrative. Rather than waiting for regulatory sanctions or an unforeseen breach, the state convened an intensive four-day Data Protection Compliance Awareness Training Programme for the Directorate Cadre and Senior Staff across its Ministries, Departments, and Agencies (MDAs).
Structured and delivered by The Rainbow Strategy – a licensed Data Protection Compliance Organisation (DPCO) – the initiative equipped senior public servants with the governance frameworks and practical tools required to comply with the Nigeria Data Protection Act (NDPA) 2023 and the General Application and Implementation Directive (GAID) 2025.
The significance of this milestone lies not merely in the classroom hours logged or certificates issued, but in the deliberate governance philosophy behind it.
As the Commissioner for Budget and Planning, Honourable Kingsley Ndidi Anosike, clearly framed during the inauguration: “We are not here because the Nigeria Data Protection Commission has put us under investigation. We are here because we have chosen to be ahead of enforcement – not behind it. That distinction matters enormously.”
Hon. Anosike’s point underscores a crucial legal and moral truth for the modern public servant. Public officers handling citizens’ data are not just administrators pushing files. They are custodians and gatekeepers of individual privacy. Under Section 37 of the 1999 Constitution of the Federal Republic of Nigeria (as amended), privacy is a fundamental right. The NDPA 2023 serves as its legislative shield. Unauthorised access, improper storage, or careless handling of citizens’ data carries real consequences, including potential personal legal liabilities for public officials who neglect their duty of care.
This realisation transforms how we view public infrastructure. Digital transformation without robust data privacy controls is a house built on sand. As Mr. Gerald Ilukwe, Chief Information Officer to the Abia State Governor, aptly noted during his closing address: “A digital government that grows without growing its data governance is not stronger. It is a more exposed one.”
Whether managing the civil service ABSSIN platform, digital tax administration through IRSA, public hospital records, or school registries, a strategic asset left unprotected ceases to be an asset. It becomes a major institutional liability.
Operationalising data protection in government requires moving beyond surface-level compliance. It demands sector-specific diligence. In the Abia State training programme, for example, the curriculum was grounded directly in operational realities:
- Finance & Revenue MDAs evaluated tax and payroll architectures against Data Protection Impact Assessment (DPIA) obligations and exposure risks.
- Education MDAs addressed the heightened protections required under Section 21 of the NDPA when handling minors’ data on e-learning registries.
- Health MDAs received targeted protocols for securing electronic patient records and managing potential health data breaches within the mandatory 72-hour regulatory notification window.
- Justice & Legal MDAs examined inter-agency data sharing frameworks, witness protection records, and litigation management.
Crucially, building a privacy-conscious society cannot stop within the walls of civil service bureaus. It must extend to the younger generation who navigate an increasingly digital world.
Through initiatives like the Nigeria Data Protection Commission’s (NDPC) Adopt-A-School project, in which organisations like The Rainbow Strategy participate, young students are being taught how to safeguard their personal information online and offline. Protecting citizens must be a continuous, societal effort, from the classroom to the cabinet room.
Abia State’s leadership, driven under the vision of Governor Alex Otti, sets a compelling benchmark for sub-national data governance in Nigeria. It demonstrates that state governments can lead proactively, embedding compliance into institutional culture long before a crisis occurs.
As the Nigeria Data Protection Commission continues to strengthen its enforcement presence across all sectors, the challenge now goes to the remaining thirty-five states and the Federal Capital Territory. Will sub-national institutions wait for public data breaches, loss of public trust, and regulatory fines to force their hands? Or will they choose to lead from the front, recognising that protecting citizens’ data is fundamentally about building citizen trust in a digital age?
The choice is clear. True governance in the 21st century requires not just building digital highways, but ensuring that every citizen walking upon them is safe, secure, and protected.
Franklyn Ginger-Eke, PhD, fnipr, FIIM, is the Founder and Chief Strategist of The Rainbow Strategy, an NDPC-licensed Data Protection Compliance Organisation (DPCO) and public affairs consultancy.
