Who Should Hear a Data Protection Complaint First?

In law, the order in which a right is exercised can sometimes matter as much as the right itself. A claimant may have a perfectly valid grievance, but the law may nevertheless require that certain steps be taken before a court can be invited to determine it. These conditions precedent serve a practical purpose: they give the designated person or institution an opportunity to address the dispute before litigation begins and, where the law intends it, make that process a necessary first step to the exercise of the right to sue.

I became particularly familiar with this principle earlier in my career, when I worked with a prominent electricity distribution company in Lagos. Whenever a customer or a partner had a grievance against a decision of NERC, there was one rule everyone in the legal team knew by heart—you went to NERC first. Skip that step and file directly in court, and our lawyers would simply ask the court to strike out the case as premature, citing the claimant's failure to exhaust the administrative process before litigating. More often than not, it worked.

That rule came back to me while listening to Justice Abiodun Akinyemi's keynote address at PrivCon 2026, delivered on the 1^st of September at the annual privacy conference in Lagos organized by Dr. Olumide Babalola. Justice Akinyemi, a serving Justice of the Court of Appeal, spent a good part of the address tracing how far Nigerian courts have come on privacy and data protection since the 1999 Constitution's Section 37. Near the end of his presentation, he raised a question that is of utmost importance, yet many could have overlooked. Section 46 of the Nigeria Data Protection Act 2023 sets up an administrative process at the NDPC for resolving data breach complaints. Justice Akinyemi asked whether a data subject is required to go through that process before they can sue, and he left the question open.

He is right to flag it, as Section 46 does not say plainly whether the administrative route is mandatory or optional. Section 50 gives a data subject the right to seek judicial review of whatever the NDPC decides, and the following section separately preserves a data subject's right to bring civil proceedings against a controller or processor. Read together, these three sections describe a process without quite committing to a sequence, and until that sequence is settled, nobody advising a client on either side of a data breach claim can say with confidence which door to walk through first.

A Lagos High Court has already tested the question, though narrowly. In Adunni Adewale v Polance Media Limited, decided in June 2025, the respondents raised Section 46 as a preliminary objection, arguing that the actress ought to have lodged a complaint with the NDPC before suing. Justice I.O. Harrison overruled the objection, holding that the claim was brought under the Fundamental Rights Enforcement Procedure Rules rather than as an ordinary civil action and that enforcement of a fundamental right is not subject to any precondition. That answers the question for a data protection grievance framed as a constitutional privacy claim, but it says nothing about an ordinary NDPA civil suit, which is worth bearing in mind given that Justice Akinyemi's keynote pointedly avoids commenting on High Court decisions that could later reach his own bench.

My own view is that Nigeria's data protection framework needs exactly this kind of clarity, and it should lean toward making the administrative process mandatory. The reasoning has nothing to do with limiting anyone's access to the courts. A functioning first-instance regulator, one with the statutory teeth to actually decide complaints rather than simply receive them, filters out disputes that never needed a judge in the first place, and it forces the regulator itself to build the kind of institutional muscle that Justice Akinyemi's keynote was largely about.

The Electricity Act 2023 settles this question for its own sector in plain terms. Section 51(5) provides that an action shall not be instituted by anyone aggrieved by a decision of the Commission without first exhausting all internal dispute settlement mechanisms under the Act. There is no ambiguity left for a court to resolve and no room for a claimant to gamble on which forum moves faster.

The NDPA does not expressly establish exhaustion as a condition precedent, and the GAID does not definitively resolve the relationship between the two routes. Indeed, Article 47 expressly affirms a data subject's right to seek redress in court, while Article 39 establishes a parallel administrative complaint mechanism at the Commission, further increasing uncertainty.

If the mandatory reading eventually wins, and a data subject files straight to court in the meantime, they lose to a jurisdictional challenge, the same outcome that met litigants who tried to bypass the NERC. If the optional reading prevails, however, the NDPC's carefully constructed complaint mechanism risks becoming a parallel avenue rather than the primary forum for first-instance resolution. That is difficult to reconcile with the extent of the machinery the GAID itself puts around a complaint: preliminary evaluation, urgent relief, investigation, pre-action conferences, and remedial orders. Neither outcome serves the person whose data was actually breached, and both are avoidable if the ambiguity gets resolved before a court has to settle it as a side effect of someone else's failed case.

There is, of course, a legitimate argument against making exhaustion mandatory: a data subject whose privacy has been violated should not necessarily have to wait for a regulator before seeking an immediate judicial remedy, particularly where the alleged breach is continuing or urgent relief is required, but that is an argument for carefully defined exceptions to exhaustion, not necessarily for leaving the basic procedural question unanswered.

The NDPC has the GAID as a live instrument, and it should not have to wait for a claimant to test this question in court before stating how it understands the relationship between the administrative and judicial routes. Justice Akinyemi's instinct, that the courts should be ready when this question eventually reaches them, is the right one. The sequencing does need fixing. The lesson from the power sector is that regulators who leave procedure to be defined by the courts usually get a procedure they did not design, handed down at the expense of a litigant who paid for the education. The best line of action for the NDPC would be to write its own rule before it is written for them.