Data sovereignty and the leaky pipe: charting a course for data governance and information security in Nigeria and Africa

Abstract

The enactment of the Nigeria Data Protection Act (NDPA) 2023 marks a significant milestone in Africa's pursuit of digital sovereignty. However, the presence of strong legislation does not automatically guarantee effective data protection in practice. This study aims to examine the pressure between Nigeria's evolving data protection framework and the real-world challenges of information security, aiming to determine whether legislative progress alone can achieve meaningful data sovereignty and whether institutional, technical, and infrastructural capacities are equally important. To achieve this, the study adopts a qualitative doctrinal legal analysis of the Malabo Convention and the Nigeria Data Protection Act (NDPA) 2023, combined with a thematic review of peer-reviewed articles, institutional reports, and industry publications from 2020-2026. Data were synthesized narratively to identify patterns, challenges, and actionable recommendations. The study finds that the NDPA 2023 marks a significant milestone, aligning Nigeria with global data protection standards. However, implementation remains constrained by weak enforcement, institutional capacity gaps, a shortage of skilled professionals, inadequate infrastructure, and dependency on foreign-owned cloud services. Key friction points include the tension between legal authority and technical capacity, disproportionate compliance burdens on SMEs, and erosion of public trust due to inconsistent enforcement. It concludes that transitioning from a passive data colony to a digital powerhouse requires sustained investment in people, institutions, and infrastructure to ensure effective implementation and enforcement of data protection laws. The study contributes theoretically by integrating legal, security, and implementation science perspectives on the data governance gap, and practically by offering a policy framework with lessons for Africa.