By Prince Osuagwu
The Director General of Essential Security Against Evolving Threats, ESET, for Nigeria and Ghana, Mr Olufemi Ake, has said that the only way Nigeria will succeed in influencing data governance that is trending around the world is that The country’s public and private organizations comply with the Nigerian Data Protection Regulation, NDPR.
He said compliance will affect the governance of data protection, information systems and security settings, as well as documented policies and processes.
Ake, speaking at a zoom conference on how organizations can comply with data protection regulations, said that these requirements are already in place and that the implications of not complying with them are complex and the possible penalties for non-compliance severe.
He argued that data encryption and creating additional authentication for data accessibility in organizations are some ways to help comply with new data security and compliance rules.
According to Ake, “The National Information Technology Development Agency, NITDA, introduced the Nigerian Data Protection Regulation, NDPR, and enforced its compliance as of January 2019 as the new requirement for the collection and processing of personal data. and requires that said activities are in accordance with legitimate Consent by the Interested Party.
“Because of this, organizations are mandated to implement compliance measures within the first year of regulation.
“Compliance with this regulation will affect the governance of data protection, information systems and security settings, as well as documented policies and processes,” added Ake.
He listed the objectives of the regulation to include: “Safeguard the rights of individuals to data privacy; promote safe conduct for transactions that involve the exchange of personal data;
“To prevent the manipulation of personal data and to ensure that Nigerian companies remain competitive in international trade through the safeguards provided by strong data protection regulations.”
NDPR applies to all personal data storage and processing carried out in respect of Nigerian citizens and residents and covers transactions intended for the processing of personal data and the actual processing of personal data and persons residing in Nigeria or residing outside Nigeria, but of Nigerian nationality.
He added that “unlike the EU General Data Protection Regulation (GDPR), NDPR does not apply to individuals and organizations outside of Nigeria that collect, store or process data from Nigerians.
“The maximum penalty for breaches of data privacy rights in international transfers can be up to 10 million naira or two percent of the gross annual income of the previous year, whichever is greater and depending on the number of stakeholders treated.
“Other massive losses that non-compliance could cause are reputational damage and prosecution of senior officers in the event of a serious data breach.”
It also affirmed ESET’s willingness to assist organizations in complying with NDPR.
He noted that “to ensure 100 percent compliance, organizations must ensure that the following solutions are proactively deployed and used.
“Organizations are strongly encouraged to obtain a data loss prevention solution, DLP, to ensure that sensitive data is not lost, misused or accessed by unauthorized users.
Most importantly, the likes of ‘Safetica’ that classify regulated, confidential and business-critical data and identify policy violations defined by organizations or within a pre-defined policy package, generally driven by regulatory compliance like HIPAA, PCI-DSS or NDPR.
“Multi-factor authentication will serve as an additional layer of data protection from unauthorized users.
“This tool will help data controllers protect all network and database logins (on premises and in the cloud) by generating a one-time password that no one knows, but is unique to a particular user and by login.
“An excellent example of such a solution is ESET Secure Authentication.
“Organizations must also implement data encryption technologies, develop an organizational policy for handling personal data (and other sensitive or confidential data), protect email systems, and ensure continuous capacity building for staff.
“Reports have shown that most organizations in Nigeria look to the above solutions to meet NDPR compliance requirements on data security.”