By Omoriyeba Hannah Adeyemi

The role of a Data Protection Officer (DPO) is central to ensuring that organizations in Nigeria comply with the provisions of the Nigeria Data Protection Act (NDPA) and its implementing guidelines. One of the foundational principles that govern the effectiveness of a DPO is independence. This principle is clearly articulated under the Article 12 of the General Application and Implementation Directive (GAID), issued by the Nigeria Data Protection Commission (NDPC).

Below is an in-depth look at what DPO independence entails under the GAID and why it is essential for fostering accountability, transparency, and trust in data processing activities.

1. Functional Independence: Autonomy in Execution of Duties

Article 12(3) provides that ‘The data controller or data processor shall ensure that the DPO does not carry out his or her task under duress, coercion, covert or overt influence’

The above provision means that Data Protection Officers  must be allowed to operate without any interference in the execution of their responsibilities This means that the organization’s management cannot:

  • Dictate how the DPO should conduct a data protection audit or investigation.
  • Interfere with the DPO’s legal interpretation of the NDPA or other applicable laws.
  • Influence decisions on whether or not to notify the NDPC about a data breach.
  • Suppress or modify recommendations made by the DPO.

This level of autonomy is not merely procedural, it ensures that data subjects’ rights are upheld without fear or favor and that compliance decisions are based on law, not convenience or internal politics.

2. Freedom from Conflict of Interest

Article 12(8) provides that: ‘The data controller or data processor shall ensure that any such tasks and duties do not result in a conflict of interest’.

To guarantee true independence, the DPO must be free from any role that causes a conflict of interest. According to the GAID, individuals whose current roles involve determining the purposes and means of data processing are not eligible to serve as DPOs.

A person cannot objectively monitor compliance with data protection rules if they are also the ones designing or implementing data systems or strategies that are under scrutiny. Roles as such IT Manager, HR Manager, Legal Officer/Manager should not serve as a Data Protection Officer to avoid conflict of interest.

A  Data Protection Officer  must not hold a position that leads them to determine the purposes or means of data processing.

  • IT Managers design and implement systems that process personal data.
  • HR Managers manage employee records and recruitment data.
  • Legal Officers often advise on how data should be handled contractually or during disputes.

If any of these roles also act as DPO, they would essentially be auditing their own decisions, which is a clear conflict of interest.

Therefore, structural separation of duties is essential to the integrity of the DPO’s function.

3. Direct Reporting to Senior Management

Article 12(5) provides that: ‘The DPO shall directly report to the management level of the controller or the processor’

A DPO must report directly to the highest level of management, such as the Chief Executive Officer, Managing Director, or the Board of Directors. This reporting line ensures that:

  • The DPO’s recommendations and findings are given appropriate visibility and weight.
  • Data protection matters are treated as strategic concerns, not just operational issues.
  • The DPO is not suppressed or overridden by mid-level managers.

This upward reporting line is also a safeguard that promotes transparency and accountability at the top level of corporate governance.

4. Protection from Retaliation or Dismissal

Article 12 (4) provides that: ‘He or she shall not be dismissed or penalised by the data controller or the data processor for performing his or her tasks’

The above provision clearly protects DPOs from unfair dismissal or penalties arising from the performance of their duties. An organization is not permitted to:

  • Discipline or demote a DPO for reporting non-compliance.
  • Remove a DPO for engaging with the NDPC or acting in defense of data subjects’ rights.
  • Penalize the DPO for issuing recommendations that may be inconvenient to the business.

This protection fosters a culture where the DPO can function as a watchdog for lawful data practices without the fear of professional consequences.

5. Provision of Adequate Resources

Article 12(2)(a) provides that: ‘The DPO shall directly report to the management level of the controller or the processor’

The independence of a DPO is not meaningful unless they are equipped with the tools and support needed to perform their duties. Accordingly, the GAID mandates that organizations provide:

  • Sufficient time to carry out data protection responsibilities.
  • Financial and logistical resources to organize training, carry out assessments, or engage consultants if needed.
  • Support staff, especially in large organizations, to help with audits, awareness campaigns, or breach response.
  • Access to information, including processing records, IT systems, contracts, and policies.

In essence, a DPO should not be “a title on paper” but an empowered and functional officer with the capacity to make a meaningful difference.

Conclusion

The independence of the Data Protection Officer is not a ceremonial feature. It is a functional requirement for trust, accountability, and lawful data governance. Under the GAID, this independence is protected through:

  • Non-interference in day-to-day duties,
  • Structural insulation from conflicts of interest,
  • High-level reporting lines,
  • Protection against dismissal or pressure,
  • And access to necessary tools and resources.

Organizations that seek to comply with the NDPA in both spirit and letter must treat the DPO role with the seriousness it deserves. Ensuring that the DPO is truly independent will not only satisfy regulatory requirements but also foster public trust and minimize data protection risks.

Written by Omoriyeba Hannah Adeyemi, Email: hannalabi@yahoo.com, 08025739234

Follow Our WhatsApp Channel ________________________________________________________________________ The Law And Practice Of Redundancy In Nigeria: A Practitioner’s Guide, Authored By A Labour & Employment Law Expert Bimbo Atilola _______________________________________________________________________

[A MUST HAVE] Evidence Act Demystified With Recent And Contemporary Cases And Materials

“Evidence Act: Complete Annotation” by renowned legal experts Sanni & Etti.

Available now for NGN 40,000 at ASC Publications, 10, Boyle Street, Onikan, Lagos. Beside High Court, TBS. Email publications@ayindesanni.com or WhatsApp +2347056667384. Purchase Link: https://paystack.com/buy/evidence-act-complete-annotation

______________________________________________________________________ ARTIFICIAL INTELLIGENCE FOR LAWYERS: A COMPREHENSIVE GUIDE Reimagine your practice with the power of AI “...this is the only Nigerian book I know of on the topic.” — Ohio Books Ltd Authored by Ben Ijeoma Adigwe, Esq., ACIArb (UK), LL.M, Dip. in Artificial Intelligence, Director, Delta State Ministry of Justice, Asaba, Nigeria. Bonus: Get a FREE eBook titled “How to Use the AI in Legalpedia and Law Pavilion” with every purchase.

How to Order: 📞 Call, Text, or WhatsApp: 08034917063 | 07055285878 📧 Email: benadigwe1@gmail.com 🌐 Website: www.benadigwe.com

Ebook Version: Access directly online at: https://selar.com/prv626

______________________________________________________________________ “Bridging Theory And Courtroom Practice” — Hagler Sunny Okorie, Nathaniel Ngozi Ikeocha Unveil ‘Functional’ Tort Law Book For Nigerian Legal System The book, titled The Law of Torts in Nigeria: A Functional Approach, authored by Professor Hagler Sunny Okorie Ph.D and Ikeocha, Nathaniel Ngozi Esq, offers law students, practitioners, and academics a comprehensive guide to understanding and applying tort law in Nigerian courts. Interested buyers can place orders via the following contact numbers: 08028636615, 08037667945, 08032253813, or +234 902 196 2209. ______________________________________________________________________ “Enhance Legal Practice With Authoritative Reports” — Alexander Payne Offers Comprehensive Law Reports, Spanning Over A Century Of Nigerian Jurisprudence

Interested buyers are encouraged to place their orders and enquiries via: 0704 444 4777, 0704 444 4999, 0818 199 9888 Website: www.alexandernigeria.com