Human rights organizations exist to protect the dignity, safety, and rights of vulnerable people. Every day, these organizations collect and process highly sensitive personal information from survivors and victims of human rights violations, including cases involving gender-based violence, torture, trafficking, child abuse, arbitrary detention, discrimination, and other forms of abuse.
While this information is essential for documentation, legal support, advocacy, referrals, and case management, it also carries significant responsibility. If improperly collected, stored, shared, or disclosed, personal data can expose victims to retaliation, stigma, discrimination, psychological harm, or further violations of their rights. Protecting personal data is therefore not merely a legal obligation—it is a fundamental aspect of protecting human rights.
Data Protection is Human Rights Protection
The right to privacy is a fundamental human right recognized under the Constitution of the Federal Republic of Nigeria and international human rights instruments. Respecting privacy helps preserve the dignity, autonomy, and security of individuals, particularly those who have already experienced harm.
For human rights organizations, protecting personal information is critical because victims often disclose deeply sensitive details with the expectation that their information will remain confidential. A data breach or unauthorized disclosure can undermine trust, discourage future reporting, compromise investigations, and place survivors and witnesses at risk.
Organizations working with vulnerable populations should therefore treat personal data with the same level of care as any other safeguarding measure.
The Nigeria Data Protection Act (NDPA)
The Nigeria Data Protection Commission is responsible for regulating data protection in Nigeria through the Nigeria Data Protection Act (NDPA). The Act establishes principles for the lawful collection, processing, storage, sharing, retention, and disposal of personal data.
The NDPA applies to organizations that process personal data in Nigeria, including non-governmental organizations, charities, foundations, community-based organizations, and civil society organizations.
Compliance is therefore not limited to private companies. Human rights organizations that collect information about beneficiaries, staff, volunteers, donors, partners, witnesses, or complainants are also expected to comply with the Act.
Why Compliance Matters
Compliance with data protection requirements offers several important benefits:
- Protects victims from further harm arising from unauthorized disclosure of their personal information.
- Builds confidence among beneficiaries, donors, partners, and the public.
- Demonstrates accountability and good organizational governance.
- Reduces the risk of data breaches and unauthorized access.
- Strengthens information security and records management.
- Enhances credibility with international donors and development partners, many of whom require robust data protection measures.
- Supports ethical human rights documentation and evidence management.
Practical Steps Human Rights Organizations Should Take
To strengthen privacy and comply with the NDPA, organizations should:
- Collect only personal data that is necessary for a specific and legitimate purpose (data minimization).
- Clearly explain why personal data is being collected and how it will be used.
- Obtain valid consent where required and maintain appropriate records.
- Develop and implement a comprehensive privacy policy.
- Establish internal data protection policies and standard operating procedures.
- Limit access to sensitive information based on organizational roles.
- Secure both physical and electronic records through appropriate technical and organizational safeguards.
- Train staff, volunteers, consultants, and interns regularly on data protection obligations.
- Develop procedures for responding to data breaches and security incidents.
- Establish mechanisms through which individuals can exercise their rights, including requests to access, correct, or erase their personal data where applicable.
- Regularly review data collection forms and digital platforms to ensure privacy-by-design principles are embedded.
Digital Platforms Require Additional Protection
Many human rights organizations now use websites, mobile applications, online reporting platforms, and digital case management systems. These systems often process highly sensitive personal information.
Organizations should ensure that digital platforms incorporate privacy-by-design features such as:
- Clear privacy notices.
- Appropriate consent mechanisms.
- Secure authentication and access controls.
- Encryption where appropriate.
- Secure data storage.
- Data retention and deletion procedures.
- User mechanisms for requesting deletion or correction of personal data.
Embedding these safeguards from the design stage helps reduce risk and demonstrates responsible data governance.
Register and Comply with the NDPC
Human rights organizations should take proactive steps to understand their obligations under the NDPA and engage with the Nigeria Data Protection Commission where applicable. Organizations that process personal data should assess their compliance requirements, implement appropriate governance measures, and complete any registration or filing obligations required under the Commission’s regulatory framework.
Compliance should not be viewed as an administrative burden but as an investment in organizational integrity, accountability, and the protection of those whose rights the organization seeks to defend.
Conclusion
Protecting personal data is an extension of protecting human dignity. Human rights organizations ask individuals to share some of the most sensitive experiences of their lives. That trust must be honoured through robust privacy practices, responsible data governance, and compliance with the Nigeria Data Protection Act.
By embedding data protection into everyday operations and complying with the requirements of the Nigeria Data Protection Commission, organizations not only reduce legal and operational risks but also reinforce their commitment to safeguarding the rights, dignity, and security of every individual they serve.
Written by
Joseph Chidiebere OSUIGWE