NDPC Launches Sector-Wide Investigation

The Nigeria Data Protection Commission (NDPC) has launched a sweeping investigation into 1,369 Nigerian companies suspected of violating the Nigeria Data Protection Act (NDPA) 2023.

The probe, announced on Monday by Mr. Babatunde Bamigboye, Head of Legal, Enforcement, and Regulations at the NDPC, targets companies in critical sectors such as:

• Banking
• Insurance
• Pensions
• Gaming
• Insurance brokerage

According to the Commission, the move is aimed at strengthening data subject rights and ensuring Nigeria’s digital economy aligns with global privacy standards.

Companies Given 21 Days to Comply

The NDPC has issued compliance notices to the affected organisations, demanding proof of adherence to the NDPA within 21 days.

The list includes:

• 795 financial institutions
• 392 insurance broker firms
• 35 insurance companies
• 10 pension companies
• 136 gaming companies

The Commission stated that these organisations must provide evidence of:

1. Filing 2024 NDPA compliance audit returns
2. Appointment of a Data Protection Officer (DPO) with full contact details
3. Implementation of technical and organisational data protection measures
4. Registration as a data controller or processor of major importance

Failure to meet these requirements could lead to sanctions and fines.

Why This Matters

Bamigboye explained that the probe aligns with the NDPC’s mission to safeguard citizens’ constitutional rights to privacy under the 1999 Constitution.

He emphasised that responsible handling of personal data is key to Nigeria’s global market participation and digital transformation.

Recent Enforcement Actions

The NDPC has already taken a tougher stance on data violations. Recently, it fined Multichoice Nigeria N766.2 million, the largest penalty since the NDPA came into effect in 2023.

However, the Commission has also adopted a remediation-first approach, encouraging organisations to comply voluntarily before fines are imposed.

“Usually, when we investigate and find a breach, if they are ready to comply with the law, what is the point of making noise? It’s only when an organization is unwilling to comply with the law that we are forced to impose sanctions,” said Dr. Vincent Olatunji, NDPC’s National Commissioner.

He added that the Commission considers Nigeria’s economic stability, ensuring that enforcement actions do not discourage foreign and local investments.

Key Takeaways

• 1,369 Nigerian companies are under investigation by the NDPC.
• Organisations have 21 days to show evidence of compliance with the NDPA 2023.
• Recent fines, such as N766.2 million against Multichoice, show the Commission’s willingness to enforce the law.
• The NDPC prioritises remediation over punishment, but non-compliant firms risk heavy sanctions.

What’s Next?

With Nigeria’s digital economy rapidly expanding, the NDPC’s actions signal a new era of accountability for data privacy. Companies that fail to comply with the NDPA risk financial penalties, reputational damage, and possible regulatory restrictions.