A 30-day countdown to a shutdown switch
On July 18, 2026, the Socio-Economic Rights and Accountability Project (SERAP) sent a letter to Senate President Godswill Akpabio and House Speaker Tajudeen Abbas demanding they withdraw the Nigeria Data Protection (Amendment) Bill, 2026. The bill, sponsored by Senator Ned Nwoko (APC, Delta North), would require social media platforms, data controllers and data processors operating in Nigeria to establish physical local offices, and would empower the Nigeria Data Protection Commission (NDPC) to shut down or prohibit the operations of any entity that fails to comply within 30 days (Punch; Leadership). SERAP, signing through Deputy Director Kolawole Oluwadare, called it a "backdoor attempt to regulate social media and expand government control over online expression" and warned it would sue if the bill passes in its current or a substantially similar form.
The case for a local-office requirement
Before dismissing this as pure censorship-by-other-means, it is worth stating the regulator's strongest argument fairly. The Nigeria Data Protection Act 2023 created the NDPC precisely because Nigerians had no reliable local address to serve breach notices, enforce judgments, or compel disclosure when a platform mishandled their data (NDPA overview; NDPC mandate). A platform with no Nigerian office and no local legal representative is, in practice, judgment-proof: a Nigerian user harmed by a data breach or algorithmic harm has to sue in California or Dublin to get relief. Local-presence rules of this kind are not exotic — the EU's GDPR requires a local representative for non-EU controllers, and India's IT Rules 2021 impose similar local-officer requirements on large platforms. A regulator that cannot compel appearance, cannot serve notice, and cannot enforce a judgment is not really a regulator at all. On that narrow point, Nwoko's bill is responding to a real gap.
Where the bill overshoots
The problem is not the local-office requirement. It is what happens after it. Under the bill as described in SERAP's letter and corroborating reporting, the NDPC — an administrative agency, not a court — can order a platform shut down or barred from operating in Nigeria within 30 days of a compliance notice, with no judicial authorization step built into that specific power (Leadership). That is a strikingly different instrument than a fine, a data-processing suspension order, or even GDPR's own toughest sanctions, none of which let a single regulator unilaterally switch off a communications platform used by tens of millions of people. SERAP's letter argues this collapses the distinction between data-protection enforcement and platform-access control, and invokes Section 45 of the Nigerian Constitution — which permits restrictions on fundamental rights only where they are reasonably justifiable in a democratic society — alongside Article 19 of the ICCPR and Article 9 of the African Charter on Human and Peoples' Rights.
Nigeria has been here before, and lost. In June 2021, the federal government suspended Twitter nationwide for seven months after the platform removed a tweet by then-President Muhammadu Buhari. The ECOWAS Court of Justice ruled on July 14, 2022 that the suspension violated Articles 9 and 19 of the ACHPR and ICCPR precisely because it had no clear legal basis and no due process, and ordered Nigeria to amend the laws and policies that made such a shutdown possible (EFF). A bill that hands an administrative commission the explicit statutory power to do exactly what the ECOWAS Court found unlawful — take down a platform without a court order — does not fix the defect the court identified. It codifies it.
The chilling effect precedes the shutdown
The more durable risk here may not even be a shutdown that actually happens. It is the leverage a standing 30-day shutdown clock gives regulators over platforms in every other dispute — content moderation requests, data-sharing demands, political pressure ahead of elections. SERAP's letter makes this point directly: local-office mandates "increase government leverage over platforms" and make informal compliance demands easier to enforce quietly, without ever triggering the formal shutdown power that draws scrutiny (Tribune). That dynamic — a credible threat used far more often than the power itself — is the same one press-freedom researchers documented as the real function of local-presence laws in Turkey and Vietnam. It rewards a platform for pre-emptively softening enforcement of hate speech, election disinformation, or government criticism to avoid ever finding out how the NDPC will use the power.
What the National Assembly should actually pass
Nigeria doesn't need to choose between an unaccountable NDPC and no local accountability at all. A workable amendment would keep the local-representative requirement — it closes a genuine enforcement gap — but route any shutdown or service-prohibition order through a Federal High Court application, with the platform given notice and a hearing before, not after, access is cut. That preserves the NDPC's ability to compel breach disclosure and data-protection compliance while keeping platform-access decisions where the ECOWAS Court has already said they belong: with a judge, not a regulator's inbox. SERAP's threatened lawsuit will likely turn on exactly this distinction. The National Assembly can save itself the litigation by writing judicial review into the bill now, rather than defending its absence in court later.