The rise of digital commerce has made personal data a vital commercial asset, placing data protection at the centre of Nigerian commercial law. The Nigeria Data Protection Act 2023 (NDPA) represents a major advancement over the Nigeria Data Protection Regulation 2019 (NDPR), addressing gaps created by the latter’s non-statutory nature, weak enforcement and regulatory ambiguities. This paper adopts a doctrinal methodology, drawing on statutes, case law, regulations, policy documents and academic literature to examine the legal framework governing personal data in commercial transactions. It compares the NDPR and NDPA with leading international instruments, including the EU’s GDPR, the UK Data Protection Act 2018 and South Africa’s POPIA. The study argues that while the NDPR initiated Nigeria’s data protection regime, its limited statutory authority reduced its effectiveness. The NDPA, by contrast, provides statutory backing, establishes the Nigeria Data Protection Commission and strengthens data subject rights, particularly within digital trade and e-commerce. However, challenges persist, including limited institutional capacity, low compliance culture among businesses and overlaps with other Nigerian laws. The paper recommends a multi-dimensional strategy involving judicial activism, stronger corporate governance, harmonisation with global standards and sustained public sensitisation. It contributes to discourse on data governance by situating Nigerian commercial practices within global debates on privacy, consumer protection and digital trade. The study concludes that although the NDPA is a progressive milestone, its effectiveness depends on political will, institutional reform and engagement with the commercial sector.