The Nigerian Ministry of Defence operates its official website without a privacy policy, yet requires visitors to submit their names and email addresses through a mandatory contact form - a practice that places the ministry in direct breach of the country's data protection law. The Foundation for Investigative Journalism (FIJ) confirmed the omission on Thursday, adding it to a growing catalogue of government institutions that collect personal information online while offering citizens no disclosure about how that information is handled.
What the Law Requires - and What the Ministry Is Ignoring
Nigeria's Data Protection Act of 2023 sets out clear obligations for any organisation that collects personal data. Controllers and processors must inform individuals of the purpose for which their data is being collected, the legal basis for processing it, how long it will be retained, and what rights are available to them as data subjects. Transparency is not optional under the framework - it is a foundational requirement, and public institutions are not exempt.
The National Information Technology Development Agency (NITDA) reinforces this standard through its own guidelines for government websites, which explicitly require such platforms to display a clear and accessible privacy policy statement. The Ministry of Defence website carries neither. A visitor who submits their details through the contact form receives no disclosure of any kind about what happens to that information after it leaves their browser.
A Pattern That Extends Across Nigerian Government
The Ministry of Defence is not an isolated case. FIJ's prior investigations have documented the same failure across multiple tiers of government. A previous report found that only one of 24 data-collecting agencies in Nigeria's north-east region maintained a privacy policy. Another investigation identified that official websites for four of the six south-west states operate in violation of data privacy requirements. What emerges from these findings is not a series of individual oversights but a structural gap between legal obligation and institutional practice.
The recurring nature of these failures points to weak enforcement rather than ignorance of the law. The NDPA 2023 exists. NITDA guidelines exist. The problem is that public institutions have faced little evident consequence for disregarding them, which reduces the incentive to comply. When a security-sector ministry - whose institutional character is built around protocols and compliance - cannot meet a basic transparency requirement on a public-facing website, the broader signal about digital governance is difficult to ignore.
Why the Absence of a Privacy Policy Matters Beyond Compliance
A privacy policy is not bureaucratic boilerplate. It is the primary mechanism through which a data subject learns what they are consenting to when they hand over their personal information. Without it, a citizen contacting the Ministry of Defence has no basis for understanding whether their name and email address will be stored indefinitely, shared with third parties, processed by automated systems, or deleted after the enquiry is resolved.
For a defence ministry specifically, the stakes of opaque data handling are not trivial. People reaching out may include journalists, researchers, former or serving personnel, and members of the public with sensitive concerns. The absence of any stated data retention or processing policy leaves those individuals without the baseline protections the law was designed to guarantee.
Accountability in government data collection is also a prerequisite for public trust. Governments that collect personal data without transparency invite justifiable scepticism about how that data is used - particularly in an environment where awareness of data breaches and digital surveillance has grown substantially among connected populations. Nigeria's data protection framework was built, in part, to bring that accountability into law. A government website that ignores the framework undermines the law's credibility from the inside.
