NDPC investigating TikTok, Truecaller for alleged data breach

The Nigeria Data Protection Commission has launched an investigation into TikTok and Truecaller over alleged data breaches as part of efforts to enforce compliance with the Nigeria Data Protection Act.

The National Commissioner and Chief Executive Officer of the NDPC, Dr Vincent Olatunji, disclosed this at a press conference in Abuja on Thursday.

He said the commission was scrutinising their compliance with data protection laws and would determine the necessary regulatory action based on its findings.

“As we speak, we have even gone to the extent of investigating multinationals. We are currently investigating TikTok and Truecaller in the area of data privacy,” he said.

He added, “Depending on our findings, if they are able to go through remediation and do what is right, we are happy to work with them.”

Olatunji also said that when the commission began monitoring compliance, only four per cent of organisations adhered to data protection regulations.

However, he noted that compliance levels had improved to over 55 per cent due to increased enforcement and engagement with stakeholders.

He explained that the NDPC does not impose immediate sanctions but adopts a remediation approach, which involves assessing breaches based on their severity, the number of affected individuals, and the potential impact on the economy.

He said that rather than announcing non-compliance outright, the commission provides companies with specific corrective measures to address their shortcomings.

The commissioner added that once a company is found to be in breach, it must maintain detailed records of its data processing activities and correct any identified failures. Organisations under scrutiny are also monitored for a period of six months to a year to ensure full compliance.

He further stated that while the commission is open to remediation, it will not hesitate to take stronger measures if necessary.

At the press conference, the NDPC also introduced the Nigeria Data Protection Act – General Application and Implementation Directive, which provides guidelines to help data controllers and processors comply with the law.

Olatunji said many organisations do not fully understand data protection regulations, leading to inadvertent breaches.

The directive, which will be available on the NDPC portal, is intended to provide clarity and reinforce the role of Data Protection Officers in ensuring compliance.

He reaffirmed its commitment to safeguarding the privacy rights of Nigerians through the implementation of the Nigeria Data Protection Act – General Application and Implementation Directive.

Olatunji described the directive as a significant milestone in Nigeria’s efforts to ensure data privacy and protection, particularly in an era where emerging technologies are reshaping digital interactions.

He stated that the NDPC began working on a robust implementation framework following the presidential assent to the Nigeria Data Protection Bill by President Bola Tinubu on June 12, 2023.

According to him, this assent aligns with Section 37 of the 1999 Constitution, which guarantees the privacy of citizens, their homes, correspondence, telephone conversations, and telegraphic communications.

He explained that in fulfilling this constitutional obligation, the commission had engaged extensively with key stakeholders, including data subjects, government agencies, corporate organisations, civil society groups, international institutions, and the media.

These engagements were aimed at ensuring that the directive reflects the expectations and realities of the evolving data protection landscape.

He announced that the directive addresses key areas such as data protection principles, lawful bases for data processing, data subjects’ rights, cross-border data transfers, compliance audit returns, and standardised grievance redress mechanisms.

He added that it also provides guidelines on data privacy impact assessments, training and certification of data protection officers, alternative dispute resolution, and global best practice benchmarking.

He also stated that the NDPC had introduced the Standard Notice to Address Grievance, a mechanism that allows individuals to directly demand remedial action from data controllers and processors without first seeking intervention from the commission.

He announced that the full implementation of the directive would commence in September 2025, allowing organisations a six-month transition period.

He added that all provisions relating to fees would take effect from January 2026.

He assured that the commission would continue to provide guidance notices and advisories to clarify legal requirements and deepen the culture of data privacy and protection in Nigeria.

He further stated that capacity-building programmes would be rolled out, and feedback would be collected through NDPC platforms to support future reviews of the directive and the development of new regulatory instruments.