MEASURING NIGERIA DATA PROTECTION ACT (NDPA) 2023 COMPLIANCE IN NIGERIAN UNIVERSITIES: A GENERAL COMPLIANCE INDEX AND EVIDENCE OF INSTITUTIONAL DECOUPLING

Abstract

Nigerian universities are amidst the most data-intensive actors in the public sector, yet no structured measurement exists of how the higher education sector performs with respect to Nigeria Data Protection Act (NDPA) 2023. This study addresses the gap by applying the concept of General Compliance Index (GCI) spanning 13 NDPA-defined domains to measure NDPA 2023 compliance in Nigerian Universities.  Stratified purposive sampling across 24 universities in northern and southern Nigeria yielded 159 valid responses; GCI scores revealed compliance levels, inter-institutional differences, and decoupling. The mean GCI of 35.79% (SD = 13.56%) positions the higher education sector in the awareness maturity band. At this level, universities recognize regulatory requirements but have not taken that recognition into daily operational practice. Only 1.7% of the 298 accredited universities filed the mandatory 2024 compliance returns with the Nigeria Data Protection Commission (NDPC). A decoupling gap of 50.9 percentage points separates privacy policy adoption (74.2%) from Data Protection Officer (DPO) appointment (23.3%), pointing to a deep structural disconnect between symbolic conformity and genuine governance investment. GCI scores differed significantly by university type (Kruskal–Wallis H(2) = 7.719, p = .021) and geopolitical region (Mann–Whitney U = 2287.5, p = .009). Role-based analysis further showed that awareness of the DPO requirement is heavily concentrated by job function (χ² = 29.314, p < .001, Cramér’s V = 0.429). Findings are interpreted through Meyer and Rowan’s institutional decoupling framework, with direct implications for the NDPC, the National Universities Commission (NUC), and university data governance practitioners.