Why Data Protection Bureau delists 19 DPCOs - ITREALMS

ITREALMS ... making leadership SENSE with digital news!

The Nigeria Data Protection Bureau (NDPB) has given reasons why it revoked the operating licence of some 19 Data Protection Compliance Organizations (DPCOs), reports ITREALMS.

NDPB said that as the privacy watchdog, it resolved to sanitize an industry grappling with growth and transitional challenges.

ITREALMS gathered that DPCOs are licenced under the Nigeria Data Protection Regulation (NDPR) to provide compliance services and guide their clients whether in the public or private sectors to adhere to privacy guidelines under the NDPR.

According to NDPB sources, most of the DPCOs have not demonstrated the requisite professionalism and capacity to carry through with these tasks despite their face-value qualification.

With this step, ITREALMS gathered also that more DPCOs would be axed if they fail to become more professional.

ITREALMS recalled that under the NDPR, DPCOs are allowed to carry out training, auditing, consulting, and provide such services or products in line with compliance requirements with the NDPR.

Part of the NDPR read: “this Regulation register and license Data Protection Compliance Organisations (DPCOs) who shall on behalf of the Agency monitor, audit, conduct training and data protection compliance consulting to all Data Controllers under this Regulation.”

ITREALMS further gathered that estimated 103 DPCOs were licensed but DPCOs licensing is an ongoing exercise by the NDPB, stressing that under the NDPR, law firms, IT service providers, professional service consultancy firms, and audit firms may be licensed to operate as DPCOs.

In a recent statement made available to ITREALMS by the NDPB, Head, Legal Enforcement and Regulations, Babatunde Bamigboye, stressed “The Bureau will also evaluate data controllers and data processors on other performance metrics including but not limited to implementation of NDPR compliant privacy policy; sensitization of data subjects on data subjects rights; filing of annual compliance audit returns and globally acceptable information security certifications.”

Investigations by ITREALMS revealed that the delisted 19 DPCOs failed to meet the minimum requirements of the NDPR including shoddy “filing of annual compliance audit returns” on behalf of their clients.

Remmy Nweke/DoP Short URLs: goo.gl, mcaf.ee, cli.gs