HEALTH DATA GOVERNANCE AND THE RIGHT TO HEALTH DATA PROTECTION IN NIGERIA: FRAGMENTATION, PROPORTIONALITY AND REGULATORY GAPS

Abstract

HEALTH DATA GOVERNANCE AND THE RIGHT TO HEALTH DATA PROTECTION IN NIGERIA: FRAGMENTATION, PROPORTIONALITY AND REGULATORY GAPS

The rapid digitisation of healthcare systems and the growing reliance on advanced data analytics have intensified concerns regarding the lawful processing, secondary use, and protection of sensitive health data. Although the Nigeria Data Protection Act (NDPA) represents a major legislative development and reflects a risk-sensitive framework for the protection of personal data. The question is whether the existing regulatory architecture sufficiently safeguards health data within an increasingly complex digital ecosystem. This paper aims to assess the framework of health data governance in Nigeria critically. It examines how the NDPA, together with the General Application and Implementation Directive (GAID) 2025, and other sectoral instruments, are able to address fragmentation, proportionality, anonymisation, and exemptions in the processing of health data. It uses a doctrinal research approach to assess the proportionality requirements under the NDPA framework. It also conducts a comparative analysis of South Africa‘s Protection of Personal Information Act (POPIA) and the General Data Protection Regulation of the European Union to provide insight into the design choices of regulations. Although the NDPA provides a robust and rights-based foundation for the protection of health data, it is not detailed in terms of proportionality architecture, prior authorisation for high-risk processing, and anonymisation standards. The GAID 2025 aims to solve the issue of fragmentation in a way by providing interpretative guidance, but it does not solve the structural disjunctions that exist in the health data governance system as a whole. The result is a system that is normatively robust but operationally patchy in terms of protecting sensitive health data. The paper reframes the issue of health data governance not only as a matter of compliance but as a structural human rights issue. The paper argues that the issue of health data protection cannot be addressed without proportionality safeguards, research limitations, and regulatory coordination.