Introduction

The evolution of corporate governance in Nigeria has led to the introduction of several progressive legal frameworks, particularly in the areas of corporate transparency and data protection. The Companies and Allied Matters Act 2020 (CAMA 2020), establishes, as a statutory/primary basis, rules aimed at promoting corporate accountability and transparency. On the other hand, the Nigerian Data Protection Act 2023 (NDPA 2023) provides a comprehensive legal framework for the protection of the personal data rights of individuals (data subjects).  

CAMA 2020 represents a significant shift in Nigeria’s corporate governance regime, introducing mechanisms designed to combat opaque ownership structures, corporate fraud, money laundering, and the misuse of corporate vehicles. One of its most notable innovations is the mandatory disclosure of Persons with Significant Control (PSC), alongside expanded requirements for the registration and public availability of company information.

Conversely, the NDPA 2023 seeks to protect the fundamental right to privacy guaranteed under Section 37 of the 1999 Constitution of the Federal Republic of Nigeria (as amended) by regulating the collection, processing, storage, and disclosure of personal data. The Act reflects Nigeria’s alignment with global data protection standards, particularly the European Union (EU) General Data Protection Regulation (GDPR). The apparent tension between these two statutes raises a critical question: can Nigeria pursue aggressive corporate transparency without undermining data privacy rights, or are these objectives inherently incompatible?

This Article argues that while there are overlaps and potential conflicts between both regimes, a careful review reveals that corporate transparency and data privacy are not mutually exclusive but must be reconciled through lawful processing, proportional disclosure, and institutional safeguards.

You may read the entire document here.