Only 12.3% of Nigeria’s Advertising Industry Compliant with Data Protection Law, NDPC Says

Only 12.3% of organisations in Nigeria’s advertising industry are currently compliant with data protection requirements, the Nigeria Data Protection Commission (NDPC) has disclosed, warning practitioners to take immediate steps to comply with the Nigeria Data Protection Act, 2023.

Dr Vincent Olatunji, National Commissioner/CEO of the NDPC, disclosed this on Monday while delivering the keynote address at a webinar organised by the Advertising Regulatory Council of Nigeria (ARCON) titled, “Understanding Data Protection and Its Regulatory Framework: Applicability to the Nigerian Advertising Industry.”

Olatunji commended Dr Olalekan Fadolapo, Director-General of ARCON, for bringing together members of the advertising industry and regulatory experts to discuss privacy and data protection at a time when technology is transforming how businesses engage consumers.

“Creativity is increasingly powered by data,” Olatunji said, adding that the objective should not necessarily be to use less data, but to ensure that data is used responsibly. He said advertising campaigns should ultimately be “lawful, ethical, and worthy of trust.”Dr Vincent Olatunji, National Commissioner/CEO of the NDPC.

Advertising enters data-driven era

Olatunji said advertising has evolved from traditional media into an increasingly digital and data-driven environment, where personal information plays a growing role in determining how brands identify, understand and target consumers.

He identified artificial intelligence (AI) and other data-driven technologies as major forces reshaping the sector, creating opportunities for innovation, audience personalisation and stronger relationships between brands and consumers.

However, he stressed that the growing use of personal information also creates an obligation for organisations to protect the individuals whose data is being processed.

“Creativity is increasingly powered by data,” Olatunji said, adding that the objective should not necessarily be to use less data, but to ensure that data is used responsibly.

He said advertising campaigns should ultimately be “lawful, ethical, and worthy of trust.”

Advertising sector faces compliance gap

The NDPC disclosed that only 12.3% of organisations in the advertising sector are currently compliant with applicable data protection requirements.

According to Olatunji, the data protection agency has identified about 216 organisations within the sector, of which only 32 are currently compliant.

He urged advertising practitioners to address identified gaps before enforcement action becomes necessary.

“The time to comply with this law is now,” he said.

The disclosure highlights the challenge facing the advertising industry as businesses increasingly rely on consumer data for targeting, profiling, personalisation and digital marketing while regulatory expectations around privacy continue to expand.

Lawful basis required for consumer data

The commission’s chief explained that organisations cannot process personal data without establishing an appropriate lawful basis for doing so.

Depending on the circumstances, lawful grounds for processing may include consent, contractual necessity, compliance with legal obligations, vital interests and public interest.

For advertisers, this means understanding what personal information is collected, where it comes from, why it is required and the lawful basis for processing it.

The requirement extends across the data-processing lifecycle and is not limited to the point at which information is initially collected.

This places greater responsibility on advertising businesses to understand how consumer information moves between brands, agencies, technology providers, data vendors and digital platforms.

Consumers can control use of their information

The webinar also examined the rights available to individuals whose personal data is being processed.

Data subjects have rights including access to their personal information, restriction of processing, data portability and objection to certain processing activities.

Organisations, Olatunji said, should establish appropriate channels through which consumers can submit privacy-related requests and ensure that such requests can be received, assessed and addressed properly.

He placed particular emphasis on direct marketing, noting that an individual’s right to object to the processing of personal data for direct marketing is absolute.

Advertisers must therefore respect valid objections and stop using the individual’s information for direct marketing purposes.

Profiling and sensitive data require safeguards

The session also examined profiling, a practice increasingly used by advertisers to analyse audiences and personalise marketing campaigns.

The NDPC urged advertisers to understand the privacy implications of profiling and other data-driven techniques, particularly where such activities involve extensive use of personal information.

The commission also highlighted the need for additional safeguards when organisations process children’s data and sensitive personal information.

Cookies and other technologies used to collect information about online users were similarly identified as areas that advertisers need to understand within the wider data protection framework.

Responsibility follows the data

Olatunji said data protection responsibilities extend across the entire advertising ecosystem.

He described a chain involving brands, advertising agencies, data providers and digital platforms, stressing that each stakeholder must understand its role in the processing of personal information.

The distinction between data controllers and data processors must also be clearly established, with contractual arrangements defining the responsibilities of different organisations where multiple parties are involved.

According to the NDPC, receiving personal information from another organisation does not automatically remove responsibility for how that information is subsequently processed or protected.

NDPC lists practical compliance measures

The NDPC advised advertising organisations to register with the NDPC where required and identify appropriate data protection personnel to support compliance activities.

It also called for clear privacy notices explaining what personal information is collected, how it is used and the parties with whom it may be shared.

Advertisers were urged to review contracts with vendors and ensure that third-party service providers comply with applicable data protection obligations.

Other recommended measures include mapping personal data, identifying privacy violations, correcting compliance gaps, regularly updating privacy policies, reviewing the data-processing chain and auditing data visibility.

Olatunji also stressed the importance of implementing appropriate technical and organisational measures, alongside effective accountability mechanisms, to protect personal information.

Financial penalties remain a consequence

The NDPC also warned that organisations that fail to meet their data protection obligations may face financial penalties and other regulatory consequences.

Olatunji urged advertising businesses to adopt a preventive approach rather than waiting for the Commission to identify violations and initiate enforcement action.

He said organisations should establish appropriate safeguards before data protection problems occur.

The approach, he said, would help businesses reduce regulatory risks while strengthening consumer confidence in how their personal information is collected and used.

AI raises stakes for responsible data use

The growing use of AI in advertising and audience analysis is increasing the importance of responsible data processing, particularly as businesses deploy technology to analyse consumer behaviour and personalise interactions.

Olatunji said technological innovation should not come at the expense of human rights and dignity.

He encouraged organisations to understand and classify the databases they hold and establish appropriate measures to protect the information within them.

“The goal is not to use less data but to use data responsibly,” he said.

For the advertising industry, the growing use of AI therefore creates both commercial opportunities and additional privacy obligations, particularly where automated systems depend on large volumes of consumer information.

NDPC seeks deeper engagement with ARCON

Olatunji called for stronger collaboration between the NDPC and ARCON to improve data protection compliance across Nigeria’s advertising industry.

He said continued engagement between the two organisations would help industry participants better understand their obligations and address practical challenges associated with implementing the data protection framework.

He also proposed further engagement with digital platforms, including opportunities for stakeholders to interact directly with technology companies, ask questions and develop a clearer understanding of privacy requirements.

The webinar underscored the growing intersection between advertising, AI and personal data, with the NDPC urging practitioners to embed privacy compliance into their everyday operations rather than treating data protection as an issue to be addressed only after regulatory intervention.