The Nigeria Data Protection Commission (NDPC) has commenced a sector-by-sector investigation into organisations suspected of breaching the Nigeria Data Protection Act (NDP Act), 2023.
According to Mr Babatunde Bamigboye, Head, Legal, Enforcement and Regulations at the commission, the exercise is aimed at safeguarding the fundamental rights, freedoms, and interests of data subjects as enshrined in the 1999 Constitution, while strengthening the legal foundations of Nigeria’s digital economy.
Business Post reports that the NDP Act was enacted to ensure Nigeria’s trusted and beneficial participation in regional and global economies through the responsible use of personal data.
The action is in line with Sections 5(i), 6(a), 6(c), 46(3), and 47(1)-(2) of the Act, the Commission said. Adding that it has issued Compliance Notices to several organizations. The names of these entities were published on August 23, 2025, in major newspapers nationwide.
Companies under investigation include banks, pension firms, gaming companies, insurance brokers, and other corporate bodies.
The affected organizations have 21 days to provide evidence of filing their NDP Act Compliance Audit Returns for 2024, proof of appointing a Data Protection Officer with their contact details, a summary of technical and organizational data protection measures, and evidence of registration as a Data Controller or Processor of Major Importance.
The NDPC warned that failure to comply with the directive could lead to enforcement actions, including enforcement orders, administrative fines, or criminal prosecution as stipulated in the Act.
The agency also reaffirmed its commitment to promoting accountability and trust within Nigeria’s data protection ecosystem while ensuring the protection of citizens’ rights and the growth of the digital economy.
Recall that the NDPC had already sanctioned some companies including Meta, Multichoice, and Fidelity Bank in recent times.