Objectives of the Code of Conduct Directive
The essence of the code of conduct is to promote ethical data practices and uniform compliance within Nigeria’s data protection framework, fostering discipline and accountability among DPCOs. It also sets standards for capacity building, professionalism, and corporate social responsibility to advance data privacy and trust in Nigeria’s digital economy.
The code is important because it sets minimum standards of practice for DPCO’s and it is presumed that these standards create the basis for which liabilities for unethical practice by a DPCO shall be assessed by the Commission.
Application of the Code of Conduct
DPCOs in Nigeria are mandated to apply the provisions of the Code along with other relevant regulatory instruments and standards prescribing standard of service. Under Article 2 of the Code, DPCOs are enjoined to do the following:
- Data Ethics Orientation: Exert deliberate efforts to encourage the adoption of data ethics particularly where a data controller or processor is permitted to exercise its discretion in data processing.
- Privacy Consciousness: Foster the advancement of fundamental rights and freedoms of data subjects whenever such rights and freedoms may be adversely impacted by data processing.
- Value Assimilation: Render compliance services while upholding the values of the Commission namely: accountability, integrity, fairness and transparency.
- Consideration: Refrain from all acts or omissions which are likely to overreach or prejudice the interest of other DPCOs.
- Proactiveness: Proactively engage with the Commission in addressing challenges of compliance particularly in the areas of awareness creation, capacity building and compliance audit returns.
Registration of DPCOs
By virtue of Article 4.1(4) of NDPR (2019) and Section 33 of the NDPA 2023, DPCOs are required to register with the Commission and this requirement is reiterated in the Code.
Law firms, Information Communication Technology (ICT) services providers and Management Consultancy firms are all eligible for registration as DPCOs when they have at least one verifiably certified data protection personnel with demonstrable proficiency in data protection or information technology fields.
DPCO’s are also required by article 6(i) of the Code to register as data controllers or processors of major importance due to the importance, sensitive and impactful value of their activities to the Nigerian economy and protection of data subjects.
Compliance Services
DPCOs are required to conduct compliance services based on agreements with data controllers or data processors.
Some of these services include the following:
- registration of the data controller or a data processor with the commission;
- developing compliance schedules;
- conducting and filing annual Compliance Audit Returns for data controllers and processors;
- conducting Data Privacy Impact Assessments; and
- preparing and reviewing data protection governance programmes, policies and compliance templates. Some of the templates may include data breach registers, record of processing activities templates and consent forms.
Responsibility of DPCOs to Data Subjects
A DPCO providing expert advice to a data subject or providing information on behalf of a data controller or processor to a data subject owes a duty of care to that data subject. The phrase duty of care under Nigerian law connotes a legal obligation imposed on an individual, or organisation, requiring adherence to a standard of reasonable comnduct and care while performing any acts that could possibly harm others.
The duty of care to data subjects within a data protection context can be observed through the establishment of adequate technical, governance and organizational measures to adequately safeguard the rights of data subjects. These measures act as mechanisms of ensuring that the personal data of data subjects is processed lawfully at all times and that data subjects can seamlessly exercise their rights under the various data protection laws.
Adequately observing the standard duty of care to data subjects helps organizations avoid punitive sanctions, and build data subjects trust which can enhance their brand, reputation and increase prestige and profitability.
Responsibility of DPCOs to the NPDC
Article 6 of the Code among other responsibilities mandates a DPCO to conduct its transactions with the Commission in a transparent and efficient manner including making transparent disclosures in all its reports pertaining to its data protection compliance and services. For instance, in filing an annual data protection audit, the DPCO must ensure that only accurate information about a data controller or processor‘s practices is captured in the audit report.
Additionally, DPCOs are obligated to engage in awareness creation activities across Nigeria, register and maintain its status as data controllers or processors of major importance, file its own data protection audit and inform the Commision of any development which in its opinion is beneficial to the Commission’s or may alter the DPCO’s business structure.
Responsibilities of DPCOs to Clients
In carrying out compliance services with respect to data privacy and protection, a DPCO owes a duty of care to the data controller or data processor in assessing its scope of work and providing a clear inception report with target outcomes on technical and organizational measures required for data privacy and protection.
The inception report must be submitted to the client and documented by the DPCO.
Audit of data processing activities is an activity that requires skill and expertise grounded in adequate knowledge of data protection laws and policies, and familiarity with standard industry and global best practices. This obligation entails that a DPCO must ensure the presence and deployment of skill, expertise and diligence in rendering data protection audit, advisory and consulting services, to ensure that only accurate assessment of organization’s data protection policies and practices. This is usually the first step to adequate compliance for any regulated organization.
It is imperative to note that this duty of care does impose on the DPCO the automatic obligation to aid an organization bridge identifiable gaps revealed by the audit of data processing activities, unless it is otherwise excluded from the terms of engagement of the DPCO.
Personal Responsibilities of the DPCOs
To ensure the that any licensed DPCO possess the necessary skills and expertise, the Code mandates the DPCOs to routinely re-train its personnel on the best practices, and updated rules and regulations of data privacy and protection, and ensure confidentiality of information that may come to their knowledge (subject to operation of law). DPCOs are equally mandated to take appropriate disciplinary measures against erring personnel as may be permitted by relevant employment laws in also report to the Commission in deserving cases.
Responsibility to other DPCOs
The Code also enjoins DPCOs to promote cordial relationships with other DPCOs. Where a data processor intends to hire a former officer of another DPCO, it is ethical for the DPCO to request a reference letter from the former DPCO who was the employer of the prospective employee.
A DPCO shall not engage in any hostile practice, it shall particularly ensure that its employee who left the employment of another DPCO do not use its knowledge of the former employer to divert the clients of its former employer. DPCOs are encouraged to be involved in the activities of the Association of Data Protection Compliance Organization of Nigeria (“ADPCON”) andv attending meetings of DPCOs.
Revocation of Licence
The Commission has the power to revoke the licence issued to a DPCO, if, in the opinion of the National Commissioner of the Commission, the DPCO has violated, aided and abetted violation of the provisions of the Nigeria Data Protection Act or any instrument issued by the Commission. Other factors which may cause revocation of a DPCO licence include conviction for any offence relating to fraud or dishonesty, bankruptcy, or the failure, refusal or neglect to pay the appropriate licensing fees as prescribed by the Commission.
Conclusion
The creation of DPCOs was an innovative provision of the NDPR, and later the NDPA, as DPCOs serve become a vehicle of ensuring that data protection compliance services are quality-based and standardised. DPCOs are also perceived as a unique source of job creation in Nigeria while deepening and fostering data privacy and protection development.
The issuance of the Code is commendable as it ensures that DPCOs abide by ascertainable ethics and conducts in the discharge of their duties which improves their services.
Article provided by INPLP member: Uche Obi San (Alliance Law Firm, Nigeria)
Discover more about the INPLP and the INPLP-Members
Dr. Tobias Höllwarth (Managing Director INPLP)
