A hearing that went smoothly, for the wrong reason
On July 23, 2026, the Senate Committee on ICT and Cyber Security held a public hearing on a bill sponsored by Senator Ned Nwoko (APC, Delta North) to amend the Nigeria Data Protection Act, 2023. Stakeholders at the hearing broadly endorsed it. Senate President Godswill Akpabio, represented by Deputy Senate Leader Lola Ashiru, called it "forward-looking and nationally significant" and insisted it was not designed to restrict or undermine platforms operating in Nigeria (Voice of Nigeria). The bill would require social media platforms, data controllers and data processors doing business in Nigeria — Facebook, X, TikTok and Instagram among them — to maintain a physical office in the country.
That consensus is worth taking seriously before dismissing it. It is also incomplete, because the hearing room did not include the part of the bill that has civil society reaching for a lawsuit.
The case for a local footprint
Nwoko's underlying argument is not unreasonable. Nigeria has roughly 47.8 million active social media users, about 20% of its population, and one of the largest online publics in Africa (DataReportal). Yet the platforms Nigerians rely on most have no local entity a regulator can serve, no local staff a user can escalate a complaint to, and no local tax presence corresponding to the value they extract from the market. Nwoko has pointed to Ireland — where Meta, Google, TikTok and X all maintain offices — as evidence that requiring corporate presence is neither exotic nor an act of hostility toward tech. Faster complaint resolution, clearer lines of accountability for law enforcement requests, and local job creation are all legitimate policy goals, and jurisdictions well outside the authoritarian playbook, from the EU's GDPR representative requirement to India's IT Rules, impose comparable local-presence obligations. A regulator that cannot locate anyone to serve a notice on is a regulator with only theoretical authority. That is a real gap, and it is fair for Nigeria to want to close it.
The clause that turns presence into leverage
The problem is what happens to a platform that doesn't comply. The bill would amend the Nigeria Data Protection Act, 2023 — which currently gives the Nigeria Data Protection Commission (NDPC) registration and enforcement powers over data controllers (Policy and Legal Advocacy Centre, NDP Act 2023 text) — so that any platform without a Nigerian office for 30 continuous days becomes liable to have its operations prohibited outright. That is not a fine, a registration penalty, or a data-processing restriction. It is a shutdown power, triggered by an administrative finding, with no statutory requirement for prior judicial authorization.
SERAP's response was to write directly to Akpabio and House Speaker Tajudeen Abbas, in a letter dated July 18, 2026, describing the bill as "a backdoor attempt to regulate social media and expand governmental control over online expression" and warning it would sue if the bill passes in its current or a substantially similar form (allAfrica). SERAP's legal theory is not speculative. It rests on Sections 39 and 45 of the Nigerian Constitution, Article 19 of the ICCPR, Article 9 of the African Charter — and, most pointedly, on a precedent Nigeria has already lost. In SERAP v. Federal Republic of Nigeria, the ECOWAS Court of Justice ruled in July 2022 that Nigeria's seven-month suspension of Twitter in 2021 was unlawful, ordering the government to ensure such suspensions do not recur (EFF; Leadership). A bill that lets the NDPC accomplish the same outcome by a different route — no political directive, just a compliance-lapse finding — is not a hypothetical constitutional problem. It is close to the exact fact pattern a regional court has already ruled against once.
Two policies wearing one bill
The honest framing is that this bill bundles a defensible local-presence requirement with an indefensible enforcement mechanism, and endorsing the former at a hearing is not the same as having scrutinized the latter. A local-office mandate with an ordinary penalty regime — escalating fines, registration suspension pending compliance, a judicially reviewable order — would achieve everything Nwoko says he wants: accountability, tax capture, faster complaint handling. Nigeria does not need a 30-day countdown to a platform ban to get a Meta office in Lagos; it needs one that a court, not only the NDPC, signs off on before it takes effect.
For a market where the NDPC itself is still building out its registration and enforcement track record, handing it an unreviewable kill switch over the country's primary channels of public communication is a disproportionate instrument for a legitimate-sounding goal. The Senate can keep the corporate-citizenship logic Nwoko is selling and still strip out the part that gives Nigeria the power to do to seven platforms at once what a regional court already told it not to do to one.