Following the signing of a Memorandum of Understanding between the Federal Inland Revenue Service and France’s tax authority on December 10, 2025, Nigerian officials reiterated that the agreement poses no threat to the country’s data sovereignty.

However, legal and technology policy expert Oladipupo Ige argues that while the assurance may be technically correct, it risks being substantively misleading.

“The claim may be formally accurate but substantively questionable,” Ige said, noting that the MoU has not been made publicly available for independent review.

Legal Ownership vs Practical Data Exposure

At the heart of Ige’s concerns is a subtle but critical distinction: retaining legal control over data does not necessarily prevent functional exposure during technical cooperation.

Based on his experience with international advisory agreements, Ige explained that foreign technical partners often gain indirect access to sensitive systems through:

• Demonstrations of internal platforms
• Use of real or sample datasets
• Joint audit simulations
• Advisory engagements requiring system-level visibility

France’s tax authority, the Direction Générale des Finances Publiques, is expected to assist Nigeria with AI-enabled audits, compliance analytics, and tax system optimisation, tasks that typically demand deep interaction with operational data environments.

Why Nigerian Tax Data Is Especially Sensitive

Ige warned that the nature of the information handled by FIRS significantly elevates the risk profile.

“From a personal data perspective, taxpayer records are highly sensitive. From an economic standpoint, corporate and financial data present equally high risks,” he said.

Deploying advanced tax technologies would likely involve:

• Reviewing system architecture
• Training AI models with Nigerian datasets
• Testing enforcement thresholds on real financial information
• Analysing sector-specific compliance behaviour

According to Ige, even a purely advisory role can entail substantial exposure. “Labelling an engagement as advisory does not, by itself, protect sovereignty,” he cautioned.

Nigeria Data Protection Act Requirements

Under the Nigeria Data Protection Act 2023, any processing of personal data must satisfy strict conditions, including lawful purpose, data minimisation, and adequate technical safeguards. While public-interest processing is permitted, Ige highlighted a major transparency gap.

“We currently do not know the scope of exposure, the specific processing activities involved, the risks, or the security controls protecting data subjects,” he said. He urged FIRS to conduct a comprehensive Data Protection Impact Assessment (DPIA) and formally notify affected taxpayers before operationalising the MoU.

Risks Beyond Personal Privacy

The concerns extend beyond individual privacy to national economic intelligence. Ige noted that even anonymised or aggregated tax data can be vulnerable to re-identification when combined with other datasets.

“Such data can expose strategic economic weaknesses, industry compliance gaps, revenue dependencies, and enforcement blind spots,” he explained.

This, he warned, could allow foreign actors to infer sensitive insights about Nigeria’s fiscal and economic structure.

Uneven Global Data Protection Standards

Ige also drew attention to what he described as an imbalance in global data governance. France enforces strict digital sovereignty measures, including SecNumCloud and strong localisation rules that limit foreign access to French public-sector data.

“France treats data protection as a sovereignty issue, yet enters partnerships that may expose the digital governance systems of developing countries,” he said.

Potential Upsides of the Partnership

Despite the risks, the agreement could deliver meaningful benefits. Nigeria may gain access to advanced tax administration expertise, exposure to mature AI-assisted compliance models, and enhanced credibility with international donors and investors.

FIRS has maintained that all Nigerian data protection laws remain in force and that France’s role under the MoU is strictly advisory.

Oversight and the Path Ahead

Ige believes the Nigeria Data Protection Commission should play a leading oversight role by:

• Reviewing the MoU for compliance with data protection laws
• Approving or rejecting proposed data exposure frameworks
• Monitoring implementation and enforcement safeguards

“The real question is not whether France will own Nigerian tax data,” Ige concluded, “but whether Nigeria is surrendering strategic informational advantage without sufficient safeguards, transparency, or long-term capacity building.”