September 30, 2026

BOUNDARIES OF WORKPLACE MONITORING IN NIGERIA: THE IMPORTANT THINGS YOU NEED TO KNOW

by Ekosolicitors

Introduction Boundaries of workplace monitoring

Imagine this, It’s 2:00 PM on a Tuesday…You’re at your desk, logged onto the company’s Wi-Fi, and you quickly open WhatsApp Web on your company laptop to vent to a friend about your manager’s unreasonable deadlines. The next morning, HR calls you in. They hand you a printed transcript of your private chat and hand you a query letter for “insubordination.”

Your immediate reaction is outrage. Isn’t this an invasion of privacy? The company’s response is standard: “You were on company property, using a company laptop, on company time.”

This scenario is playing out across Nigeria as the modern workplace becomes increasingly digitised, especially with the rise of remote and hybrid work models. Employers want to protect their trade secrets, monitor productivity, and prevent misconduct. Employees, on the other hand, expect their personal data, correspondence, and dignity to remain intact.

The Legal Framework and NICN’s Jurisprudence on the legal Boundaries of Workplace monitoring

In Nigeria, signing an employment contract does not mean signing away fundamental rights. Section 37 of the 1999 Constitution as amended guarantees the privacy of citizens, their homes, correspondence, and telephone conversations. Additionally, the Nigeria Data Protection Act (NDPA) 2023 and the NDPA General Application and Implementation Directive (GAID) 2025 strictly regulate how an employer (the Data Controller) can process an employee’s personal data.

The NDPA has significantly expanded this framework by explicitly classifying employees as “data subjects.” This grants them specific rights to access, correct, and object to data collected via workplace surveillance (such as CCTV footage or email monitoring) under Section 34 of the NDPA 2023. Employers must rely on a lawful basis for this processing, typically “legitimate interest,” as outlined in Section 25 of the Act. However, this legitimate interest must be strictly balanced against the employee’s constitutional privacy rights, transforming surveillance from a unilateral management decision into a process requiring robust legal justification.

The National Industrial Court of Nigeria (NICN) has increasingly stepped in to referee these disputes, showing a strong protective stance toward employee privacy:

Post-Employment Digital Identity: In Mr. Kehinde Adeniyi Johnson v Lafarge African Plc, an employee sued his former employer for continuing to use his personal data long after his exit, exposing him to distress. The underlying principle is that an employer’s right to process data usually expires when the employment does.
Invasive Investigations: In Ginikachukwu Loyce Nze v Opitava Capital Partners Limited, the court was asked to scrutinise the methods employers use to extract information. Aggressive interrogations or unauthorised device searches during internal investigations can violate data privacy and fundamental rights to dignity.
Confidentiality of HR Records: In Dr. Uchenna Jerome Orji Esq. v Mr. Daniel Okereke & Ors, the claimant sued after internal HR communications were circulated to unconnected staff members, reinforcing that workplace privacy includes the right to strictly confidential employment records.

Areas of Intersection: Where Rights Clash

The tension between management oversight and employee privacy visibly intersects in several day-to-day operational areas:

Remote Work, BYOD, and Device Monitoring: With Bring Your Own Device (BYOD) policies, the line between professional and private digital spaces blurs. If an employer deploys monitoring software on devices used by Nigeria-based staff, they are processing Nigerian resident data and must comply with the NDPA. Secretly monitoring employee devices violates transparency principles, and accessing private communications without compelling justification can breach the NDPA and infringe on the right to dignity under Section 34 of the 1999 Constitution.
Biometric Data and Access Systems: Using fingerprint scanners or facial recognition for clocking in processes highly sensitive biometric data. Under the NDPA GAID 2025, processing biometric data is classified as a ‘high-risk’ activity. Employers must secure this data against breaches and demonstrate that such intrusive systems are strictly necessary and proportionate to the security risks they aim to prevent.
CCTV in the Physical Workplace: Surveillance via CCTV is not prohibited, but merely placing cameras in the workplace is insufficient for compliance. Employers must be transparent, explicitly notifying workers of camera locations and their purpose (e.g., preventing theft). Crucially, this legitimate interest must not extend to areas where employees have a reasonable expectation of spatial privacy, such as restrooms, locker rooms, or break areas.
Off-Duty Monitoring and Social Media: Employers increasingly monitor employees’ social media to protect corporate reputation. However, monitoring personal social media accounts accessed on company devices, or tracking an employee outside of work hours, often exceeds the threshold of necessity. If the monitoring is disproportionate, it may violate both the NDPA and Section 37 constitutional privacy rights.

Practical Solutions and Legal Analysisboundaries of workplace monitoring

The proliferation of digital surveillance tools often creates a digital panopticon that can fuel mistrust and negatively impact employee wellbeing. From a legal perspective, relying on “legitimate interest” is a tightrope walk for employers. It is not a blank cheque; it demands strict adherence to data minimisation, collecting only what is absolutely necessary.

To navigate this thin line effectively, companies should implement the following solutions:

Conduct Data Privacy Impact Assessments (DPIAs): Before deploying high-risk surveillance technologies (like biometrics, GPS tracking, or continuous keystroke loggers), employers must conduct a formal DPIA under Section 28 of the NDPA and the GAID 2025. This assesses the necessity and proportionality of the surveillance against the potential risks to employee privacy, serving as a critical defensive document in the event of litigation.
Implement Transparent Acceptable Use Policies: Covert surveillance is a legal minefield. Employers must draft clear IT and Acceptable Use Policies that explicitly state what is being monitored, how, and why. Providing employees with a clear Privacy Notice ensures transparency, establishes a diminished expectation of privacy on company devices, and moves away from relying on invalid blanket consent, which is strictly governed by Section 26 of the NDPA.
Shift to Outcome-Based Metrics: Rather than logging every keystroke or tracking idle time, employers should focus on outcome-based performance metrics. This approach significantly lowers the legal risk of violating the data minimization principles set out in Section 24 of the NDPA and preserves the implied contractual duty of mutual trust and confidence.

References to boundaries of workplace monitoring

Constitution of the Federal Republic of Nigeria 1999 (as amended).
Nigeria Data Protection Act (NDPA) 2023.
Nigeria Data Protection Commission, NDPA General Application and Implementation Directive (GAID)(2025).
Mr. Kehinde Adeniyi Johnson v Lafarge African Plc (NICN).
Ginikachukwu Loyce Nze v Opitava Capital Partners Limited (NICN).
Dr. Uchenna Jerome Orji Esq. v Mr. Daniel Okereke & Ors (NICN).
Dentons ACAS-Law, ‘Workplace Data Privacy in Nigeria: Key Obligations and Rights’ (Dentons, 28 July 2025) <https://www.dentonsacaslaw.com/en/insights/articles/2025/july/28/workplace-data-privacy-in-nigeria> accessed 13 September 2026.
DLA Piper Africa, ‘Workplace Surveillance and Employee Rights’ (DLA Piper, 26 June 2025).
eMonitor, ‘Nigeria Employee Monitoring Laws NDPA: Employer Guide’ (eMonitor, 2026) <https://www.employee-monitoring.net/compliance/employee-monitoring-laws-nigeria> accessed 13 September 2026.
Xential LP, ‘Can Nigerian Employers Monitor Employees’ Devices and Emails?’ (Xential LP, 3 June 2026) <https://xentialp.com/7002-2/> accessed 13 September 2026.