The Socio-Economic Rights and Accountability Project (SERAP) has told Nigeria's National Assembly to withdraw the Nigeria Data Protection (Amendment) Bill, 2026, warning it will sue if the bill passes in its current or a substantially similar form. In a letter dated July 18, 2026, addressed to Senate President Godswill Akpabio and House Speaker Tajudeen Abbas, SERAP Deputy Director Kolawole Oluwadare called the bill a "backdoor attempt" to regulate social media and expand state control over online expression.
What The Bill Does
The bill, sponsored by Senator Ned Nwoko (APC, Delta North), would require social media platforms, data controllers and data processors operating in Nigeria — Facebook, X, TikTok, Instagram and others — to establish physical offices in the country. Entities that fail to comply within 30 days could be shut down or have their operations prohibited by the Nigeria Data Protection Commission (NDPC), the regulator created by the Nigeria Data Protection Act (NDPA) 2023. Nwoko has pushed versions of this idea before; he revived it most recently in December 2025 after a viral, later-retracted TikTok video falsely accused him of plotting to kill his estranged wife, actress Regina Daniels, and argued that local incorporation would make litigation against platforms cheaper and content moderation easier to enforce.
Steelmanning The Bill
Nwoko's underlying complaint is not baseless. Nigerians defamed, harassed or extorted on platforms with no legal presence in the country genuinely struggle to get a court order enforced or a takedown actioned — foreign platforms can simply ignore a Nigerian subpoena with no local entity to serve. Local incorporation would also let NDPC collect data-controller registration fees and taxes directly, and Nwoko's argument that it supports "technology transfer" and job creation echoes similar local-presence rules the EU, India and Turkey have each adopted in some form for large platforms. A regulator with zero enforcement leverage over the companies that hold the most Nigerian personal data is a real accountability gap, and critics of the bill should engage with that gap rather than dismiss it.
Where SERAP's Objection Bites
But the bill's mechanism is what makes it dangerous, and Nigeria has already litigated a near-identical dispute. SERAP's letter argues the bill fails Section 45 of the Nigerian Constitution, which allows restrictions on fundamental rights only where they are "reasonably justifiable in a democratic society" — a three-part test of legality, necessity and proportionality. A 30-day countdown to a full platform shutdown, with no requirement for prior judicial authorization and no obligation on NDPC to consider narrower remedies (fines, specific-content orders, phased compliance), fails that test on its face. SERAP also points to the ECOWAS Community Court of Justice's July 2022 ruling that Nigeria's 2021 Twitter suspension — imposed for seven months after Twitter deleted a tweet from then-President Muhammadu Buhari — violated the right to freedom of expression under the African Charter on Human and Peoples' Rights and the International Covenant on Civil and Political Rights. Twitter was reinstated in January 2022 only after agreeing to open a local office, appoint a country representative and pay local taxes — the same demands this bill would now write into statute, backed by the same shutdown threat a regional court already found unlawful.
That precedent matters because it shows the local-office requirement is rarely just about tax collection or process-serving. As SERAP put it, "requirements compelling technology companies to establish local offices would increase government leverage over platforms, facilitate political pressure, make censorship demands easier and expose local employees to retaliation." A platform with Nigerian staff and a Nigerian office is a platform whose local employees can be summoned, threatened with liability, or pressured into content decisions in ways a purely foreign entity cannot be. That is precisely the leverage the Buhari government exercised in 2021, and precisely what the ECOWAS Court told Nigeria not to repeat.
The Innovation Cost
The compliance burden also falls hardest on the businesses Nigeria says it wants to attract. NDPC's existing registration fees under the NDPA 2023 framework already scale by size — smaller entities pay less than major data controllers — but a hard local-office mandate is a fixed cost that a two-person AI startup or a university research lab cannot absorb the way Meta or TikTok can. SERAP warned the bill could raise compliance costs for startups, AI developers, researchers and educational institutions, making Nigeria less attractive for the same digital investment the government's own AI and digital-economy strategies are trying to court.
What Should Happen Instead
Nigeria does not need to choose between an unaccountable regulator and a shutdown-by-default regime. NDPC already has registration and audit powers under the 2023 Act; strengthening judicial sign-off before any suspension order, tiering local-presence requirements to company size or user reach (as the EU's Digital Services Act does with "very large online platforms"), and giving companies a graduated remedy period rather than a flat 30 days would address Nwoko's enforcement-gap concern without recreating the exact legal exposure Nigeria already lost in front of the ECOWAS Court. The National Assembly does not have to guess whether SERAP will sue — it already knows what a court did with this theory once. Passing a near-identical bill and inviting a second ruling is not proportionate regulation; it is a rerun of a mistake with the outcome already known.