DataMedics DataMedics
Data Ethics and Protection: Law, Rights and Responsible Practice

Foundations: ethics, privacy and the law

Why this matters now: the global shift

See how data protection went from a quiet corner to record fines in a few years, why the rules now reach a business almost anywhere, and the real penalties that prove it.

By the end of this lesson you can explain the recent shift to strong data protection law, and why it can reach a business in one country from the rules of another.

Why it matters

A few years ago, data protection was a quiet specialism. Today it decides fines large enough to dent a global company, and it has created a new profession. If you understand why the shift happened and how far the rules reach, you can see both the risk to avoid and the opportunity to seize.

The idea in plain words

As more of life moved online, organisations gathered more data about people than ever before, and a run of scandals showed how badly it could be misused. Lawmakers responded. Europe's General Data Protection Regulation, the GDPR, took effect in 2018 and became the template much of the world copied. Nigeria followed with a regulation in 2019 and then a full Act in 2023. Brazil, South Africa, Kenya, China, India and many others passed their own laws in the same wave.

Two features make these laws bite. First, the fines are large, often a share of a company's worldwide turnover, so they hurt even the biggest firms. Second, many of the laws reach beyond their own borders: if you offer goods or services to people in a country, or monitor people there, that country's law can apply to you even if your office is somewhere else.


1948UDHR 1995EU Directive 2018GDPR 2019NDPR 2023NDPA

A long-standing right, then a wave of modern laws from 2018 onward. (Dates: UDHR 1948; EU Data Protection Directive 1995; GDPR in force 2018; Nigeria's NDPR 2019 and NDPA 2023.)

Extraterritorial reach: a law that can apply to organisations outside the country, when they offer goods or services to people inside it or monitor people there. The GDPR works this way, which is why it reaches far beyond Europe.

See it done

The penalties are not theoretical. A few real, reported examples show the scale.

  • Under the GDPR, Meta was fined 1.2 billion euros by Ireland's regulator in 2023 for unlawfully transferring European users' data to the United States. This is the largest GDPR fine to date. (Reported by Termly's tracker of GDPR fines.)
  • In Nigeria, the Data Protection Commission reported that it had collected about 7.2 billion naira from registrations, compliance revenue and fines as it stepped up enforcement under the 2023 Act. (Reported by Techmoonshot, February 2026.)
  • Also in Nigeria, the Federal Competition and Consumer Protection Commission fined Meta and WhatsApp 220 million US dollars in 2024 over how they handled users' data. (Reported by JURIST.)

Now follow the reach. Imagine a Lagos software business that sells a subscription app to customers in Germany. Because it offers a service to people in the European Union, the GDPR can apply to it, even though its office is in Nigeria. So it must meet both Nigeria's NDPA at home and the GDPR for its European users. That is why this subject matters to businesses far from Europe.

Your turn, with help

A small online shop in Nairobi starts shipping to customers in France and stores their names and addresses.

  1. Could an outside country's data protection law apply to this Kenyan shop?
  2. Why?

Hints: Who are the shop's new customers, and where are they?

Show the answer
  1. Yes. The European Union's GDPR could apply, alongside Kenya's own Data Protection Act.
  2. Because the shop is offering goods to people located in the EU and handling their personal data, which brings it within the GDPR's extraterritorial reach.

Your turn, alone

  1. In one sentence, why did strong data protection laws spread so quickly after 2018?
  2. Name two reasons these laws "bite" even against large companies.
  3. Give one real, cited example of a data protection penalty from this lesson, with its figure.

Watch out

  • Do not assume distance protects you. A business far from Europe can still fall under the GDPR if it serves people there.
  • Do not quote a fine you cannot check. Only use penalty figures from a named, reliable source, exactly as this lesson does.
  • The law keeps moving. New countries pass laws and raise fines every year, so treat any single figure as a snapshot, not the final word.

Say it back

  1. What law, in force from 2018, became the template others copied?
  2. What does "extraterritorial reach" mean?
  3. Why must a Nigerian business serving EU customers care about the GDPR?

What is next

You now have the foundations: what personal data is, who is responsible, what processing means, how ethics sits above the law, and why all of this matters now. In Module 2 we turn to the engine room: the core principles that every one of these laws is built on, and that decide whether any use of data is allowed.