… As conferees seek data Governance Maturity Model
Participants at the recently held breakfast session by the Chartered Institute of Bankers of Nigeria (CIBN) Centre for Financial Studies in Lagos have agreed that henceforth, banks must adopt serious fact-checking process on every third party deals.
The aim, according to the industry experts is to ensure sustainable data protection regime in Nigerian financial institutions.
This is as the bankers’ called for inclusion of Data Governance Maturity Model ahead of robust introduction of the National Data Protection Regulation (NDPR).
While cautioning against cases of over-regulation the participants’ averred that “National Information Technology Development Agency (NITDA) should learn from the Central Bank of Nigeria in introducing regulations. The typical process for CBN in introducing regulations involves stakeholder engagements across industries concerned, public and private sector engagements as well as the development and final adoption of exposure drafts.
The communiqué which dwelt on ‘Managing the new oil – Data protection and management strategies for the Nigerian banking sector,’ read in parts: “Banks must be more stringent when considering third party engagements. Such engagements must be scrutinised more thoroughly in order to reduce the likelihood of data breaches.”
Also, it noted that behavioural characteristics of those handling sensitive data should be scrutinised and confirmed beyond reasonable doubt ahead of official deployments.
The experts further recommended that “Data champions and stewards who would monitor data use from one process (collection, transfer, usage), to the other should be employed, and there should be adequate training and retraining for these agents as well as data controllers handling sensitive data.”
Apart from calling for synergy amongst the IT, compliance and legal departments in assessing strategies to handle data security in every organisations, the communiqué observed that “It was important for individuals and organisations to gain a better understanding of processes in which data breaches could occur, such as in data collection, transfer or usage.
“A dispute resolution team should be developed to settle cases of data breaches across various industries. Organise several more fora in the pilot phase of the dispute resolution.
“A more robust response to data breaches should be developed in the NDPR guidelines. That is, a strong deterrent to breaches in data privacy should be developed so as to ensure that data breaches are not easy to accomplish,” participants noted.
