A Compliance Clock With No Judge Watching It
On July 18, 2026, the Socio-Economic Rights and Accountability Project (SERAP) wrote to Senate President Godswill Akpabio and House Speaker Tajudeen Abbas demanding they withdraw the Nigeria Data Protection (Amendment) Bill, 2026, or face a lawsuit. The letter, signed by SERAP Deputy Director Kolawole Oluwadare, targets a single clause: section 5(p), which would let the Nigeria Data Protection Commission (NDPC) "prohibit entities from conducting operations in Nigeria" — in effect, shut down a social media platform, data controller, or data processor — if it fails to establish a physical office in the country within 30 days (Punch; Vanguard). The bill, sponsored by Senator Ned Nwoko (APC, Delta North), amends the Nigeria Data Protection Act 2023, the law that created the NDPC and which the commission still administers (NDPC).
The Case for Local Presence
SERAP's objection deserves to be met on its strongest terms, not dismissed as reflexive tech-industry pushback. Requiring foreign platforms to maintain a local legal presence is not a fringe idea — the EU's DSA, India's IT Rules, and Brazil's Marco Civil all impose some version of a local-representative requirement, precisely because victims of platform-enabled harm (fraud, harassment, child-safety violations) have often had no addressable entity to serve process on when the company operating in their country sits entirely offshore. Nigeria's own regulators have struggled with this: a platform can generate enormous local user harm while having zero accountable staff, zero seizable assets, and zero enforcement leverage inside the jurisdiction. A registration requirement tied to compliance is a legitimate regulatory instrument, and NDPC — a young agency established under a 2023 Act still building its enforcement muscle — has a real interest in not being toothless against the largest platforms operating in its market.
Where the Bill Overshoots
The problem is not the office requirement itself; it is what happens when a platform misses the deadline. SERAP's letter invokes Section 45 of the Nigerian Constitution (the proportionality and necessity test for restricting rights) and Section 39 (freedom of expression), alongside Article 9 of the African Charter on Human and Peoples' Rights and Article 19 of the ICCPR, arguing the bill fails all four (Vanguard). The specific defect: section 5(p) contains no requirement for prior judicial authorisation, no obligation on NDPC to consider less restrictive alternatives — a formal warning, an escalating fine, a phased compliance schedule — and no meaningful window for a platform to remedy the lapse beyond the flat 30 days (Punch). A platform could be excluded from the Nigerian market over an administrative paperwork failure, with the same unilateral speed that would apply to a platform actively facilitating serious harm. The statute doesn't distinguish between the two.
SERAP also flags a second-order risk worth taking seriously: mandatory local offices, paired with a shutdown threat, "would increase government leverage over platforms, facilitate political pressure, make censorship demands easier and expose local employees to retaliation" (serap-nigeria.org via search). This is not hypothetical — platforms with local staff in jurisdictions with weak due-process norms have repeatedly faced pressure campaigns routed through those employees rather than through courts. A shutdown power with no judicial check makes that leverage more usable, not less.
Nigeria Has Run This Experiment Before
Nigeria doesn't need to speculate about what an unchecked platform shutdown costs. On June 5, 2021, the federal government suspended Twitter entirely, without any statutory basis resembling section 5(p) — an executive act, not even a properly legislated one. The ban lasted 222 days, until January 12, 2022, and cost the economy an estimated ₦546.5 billion (about $1.5 billion), a figure built from NetBlocks' hourly Cost of Shutdown Tool at roughly ₦103 million lost per hour (legit.ng). That episode is the closest real-world precedent for what section 5(p) would formalize into statute — except the new bill would apply the trigger to office-registration compliance rather than any allegation of harmful content, and would hand that power to a regulator rather than requiring a presidential order that at least carried some political accountability.
SERAP's letter also notes this isn't Nwoko's first attempt at a similar framework — the bill "revives substantially similar proposals" that generated public opposition before (Punch). Recycling a contested provision under new bill numbering doesn't answer the objections that sank it previously.
The Fix Is Narrow, Not a Withdrawal
SERAP is asking for full withdrawal; the more proportionate fix is narrower. Keep the local-office requirement — it is defensible regulatory policy consistent with global norms. But strip the unilateral shutdown trigger from an administrative compliance failure and replace it with tiered enforcement: fines that scale with delay, a mandatory judicial or independent-tribunal review before any market-access suspension, and a shutdown power reserved for demonstrated, serious ongoing harm rather than a missed registration deadline. NDPC needs enforcement teeth. It does not need — and Nigerian internet users can't afford — a repeat of 2021 dressed up as data protection law.