Analysis of the Nigerian Data Protection Act 2023 and the Regulatory Framework for Fintech in Nigeria: Towards a Cohesive Regime

Abstract

The Nigerian Data Protection Act (NDPA) 2023 represents a significant milestone in the evolution of data privacy regulations in Nigeria, particularly for the fintech sector, which handles vast amounts of sensitive personal and financial data. This paper compares the Act with its immediate predecessor, the Nigerian Data Protection Regulation (NDPR) 2019, and with the benchmark EU General Data Protection Regulation (GDPR). The essence of this comparative analysis is threefold: first, to identify the substantive legal improvements introduced by the NDPA 2023; second, to highlight remaining regulatory gaps relevant to the fintech sector; and third, to assess Nigeria's level of convergence with internationally accepted data protection principles. The paper further examines the doctrinal implications of the NDPA's provisions for fintech companies, emphasising the operational and reputational necessity of compliance. It also addresses key challenges to the Act's implementation, including vague terminology, limited public awareness, and a shortage of trained data protection professionals. By acknowledging these advancements and obstacles, the study concludes with targeted recommendations for enhancing data literacy, clarifying regulatory requirements, and strengthening enforcement with the aim of ensuring robust data protection within Nigeria's rapidly growing fintech industry.