Data Protection Compliance Organizations (DPCO) Under the NDPR, and Monitoring Bodies Under the GDPR: Two Sides of the Same Compliance Coin?

Abstract

The European Union (EU) Data Protection Directive (DPD) was repealed for its failure to achieve the anticipated level of regulatory compliance thereby paving the way for General Data Protection Regulation (GDPR) which came with a number of novelties including the introduction of monitoring bodies (MBs) as another layer of compliance enforcement with provisions of the GDPR through sector-specific codes of conduct (CoC). While the DPD also had a provision on CoC, it was bereft of its enforcement mechanism, success indicators and workability, hence the introduction of MBs as an additional player in the GDPR-enforcement ecosystem to ensure compliance with the CoC on the one hand and sanction violations on the other. Conversely, on the other side of the Mediterranean Sea, Nigeria issued its own version of the GDPR as ‘Nigeria Data Protection Regulation’ (NDPR) and introduced its own peculiar MB styled ‘Data Protection Compliance Organization’ (DPCO) to, interestingly, on behalf of the National Information Technology Development Agency (NITDA) ensure and monitor compliance with the NDPR and at the same time forge a fiduciary relationship with the controllers as their paid auditors. This article places the European concept of MBs and Nigerian novelty of DPCOs side by side while examining the relationship between the two similar yet asymmetric concepts. The article analyses the varying issues surrounding the nature, appointment or creation, powers, and functionalities of MBs and DPCOs under the European and Nigerian regulations. Nigeria, Nigeria Data Protection Regulation, NDPR, National Information Technology Development Agency, NITDA, Data Protection Compliance Organization, DPCO