Beyond the Individual Claim: Where Arbitration Actually Fits in Nigeria's Data Protection Framework 

Nigerian scholarship on the arbitrability of data privacy disputes has settled one question: an arbitration clause cannot oust the constitutional jurisdiction of the courts over an individual data subject's claim for breach of the right to privacy under section 37 of the 1999 Constitution. This article argues that this settled answer addresses only one of two distinct categories of dispute arising under Nigeria's data protection framework. Alongside the individual data subject's claim against a controller sits a separate, commercial category: disputes between a controller and a processor, between joint controllers, or between a controller and the vendors it engages under the written data processing agreements the Nigeria Data Protection Act 2023 requires. No data subject is a party to these disputes, and no constitutional right is directly adjudicated by resolving them. Drawing on a live 2026 Nigerian data breach investigation, Nigerian case law on arbitrability and on data protection as a constitutional right, and the Commission's own General Application and Implementation Directive 2025, this article develops a three-part doctrinal test, the non-preclusion test, for distinguishing individual-rights disputes from commercial controller-processor disputes, and argues that the latter are readily arbitrable under the Arbitration and Mediation Act 2023. The article situates this claim against existing Nigerian and international scholarship, engages a live drafting proposal in the form of a model dispute resolution clause, and closes with recommendations for the Commission, contract drafters, the judiciary, and Nigeria's arbitral institutions. To the best of available scholarship, this article is the first to draw this distinction under Nigerian law and to propose a test for administering it.