The Nigeria Data Protection Commission (NDPC), in furtherance of its mandate under the Nigeria Data Protection Act (NDP Act), 2023, has commenced a sector-by-sector investigation of organisations suspected of non-compliance with the provisions of the Act.

The NDP Act, 2023 seeks to:

1. Safeguard the fundamental rights, freedoms, and interests of data subjects as guaranteed under the Constitution of the Federal Republic of Nigeria, 1999.

2. Strengthen the legal foundations of Nigeria’s digital economy while ensuring the nation’s trusted and beneficial participation in regional and global economies through responsible use of personal data.

In line with Sections 5(i), 6(a), 6(c), 46(3), and 47(1)-(2) of the NDP Act, the Commission has issued Compliance Notices to certain organisations listed in the schedule of its notice. The list of these organisations will be published on Monday, 25th August 2025, in some major newspapers across the country. The list of organisations were drawn from insurance companies, pension companies, gaming companies, banks, and insurance brokers.

These organisations are required to, within twenty-one (21) days of issuance, provide the following:

1. Evidence of filing NDP Act Compliance Audit Returns for 2024 (S.6(d) of the NDP Act).

2. Evidence of designation or appointment of a Data Protection Officer, including name and contact details (S.32).

3. Summary of technical and organisational measures for data protection within the organisation (S.39).

4. Evidence of registration as a Data Controller or Processor of Major Importance (S.44).

The Commission reiterates that failure to comply with this Compliance Notice may result in enforcement actions, including the issuance of an Enforcement Order, administrative fines, and/or criminal prosecution in accordance with the NDP Act, 2023.

The NDPC remains committed to ensuring a culture of accountability and trust in Nigeria’s data protection and privacy ecosystem, while safeguarding the rights of data subjects and strengthening the nation’s digital economy.

Babatunde Bamigboye, Esq.
Head, Legal, Enforcement and Regulations
NDPC

The Nigeria Data Protection Commission (NDPC) has signed a landmark Memorandum of Understanding (MOU) on Data Governance with the Bauchi State Government, solidifying a partnership aimed at enhancing data protection and compliance with the Nigeria Data Protection Act (NDP Act), 2023.
The signing ceremony took place during the launch of the State’s Cybernation and Digital Literacy Skills programme. At the event, the Executive Governor of Bauchi State, His Excellency Senator Bala Abdulkadir Mohammed, emphasised the importance of data protection in building a trustworthy and sustainable digital economy. In his words, “Ministries, Departments and Agencies of government in the state must align their data processing activities with the Nigeria Data Protection Act, 2023. I have approved the establishment of a Data Protection Service Unit for the State.”
Governor Mohammed also commended the visionary leadership of Dr. Vincent Olatunji in steering the data protection ecosystem in Nigeria, underscoring a strategic move to safeguard citizens’ digital rights and build trust in the state’s growing digital economy.
In line with the MOU, the collaboration is designed to promote compliance with the NDP Act through several key initiatives, including:
• Developing and implementing state-wide data protection policies.
• Building capacity for public institutions and civil servants.
• Launching awareness campaigns for citizens and businesses.
• Establishing data compliance frameworks across Ministries, Departments, and Agencies (MDAs).
• Upholding data subject rights.
In his address during the ceremony, the National Commissioner/CEO of the NDPC, Dr Vincent Olatunji, who was represented by the Head of Legal, Enforcement, and Regulations of the Commission, Babatunde Bamigboye, Esq., commended the State Government for the historic initiative on data privacy and protection.
He recalled the historic step taken by His Excellency, President Bola Ahmed Tinubu, GCFR, in signing the Nigeria Data Protection Bill into law in 2023. He highlighted the subsequent release of the NDP-Act General and Implementation Directive, 2025, by the NDPC to provide guidance for the implementation of the NDP Act.
This step consolidated Nigeria’s efforts in protecting the fundamental rights and freedoms of Nigerians in the Fourth Industrial Revolution (4IR). He pledged the support of the NDPC by mainstreaming data protection principles into the laudable initiatives of the Bauchi State Government aimed at building a trustworthy digital economy.
Dr Olatunji pointed out that unlike previous industrial revolutions where African nations were relegated to being suppliers of raw materials and consumers of finished goods, the 4IR empowers every village to become a potential hub of production. To achieve this, all levels of government must work together to guarantee the 5Vs of data: Value, Volume, Veracity, Variety, and Velocity.
With a population of about 230 million people and over 250 ethnic groups, Nigeria has what it takes to start, but warned that the real challenge lies in sustainability. He explained that data protection is the key to this sustainability, as it builds the trust thempowers the data processing value chain, secures investor confidence, and facilitates cross-border data flows for mutual economic development.
Dr. Olatunji also detailed the risks citizens face without proper data protection, including identity theft, loss of assets, and exclusion from essential social and economic services. He noted that over 130 countries worldwide are addressing these risks by enacting robust data protection laws, and establishing independent Data Protection Authorities (DPAs), in order to ensure the adequacy of data protection as a precondition for cross-border data transfers.
He emphasised that the Federal Government cannot accomplish this alone, and that collaboration with sub-national governments is not just beneficial, but necessary.
He concluded that Nigeria’s success in this digital future is dependent on the ability of national and sub-national governments to work together to protect the data of every Nigerian citizen, thereby securing and consolidating the nation’s socio-economic.

Signed
Itunu Dosekun
Head, Media Unit, NDPC

In a significant move toward strengthening regional collaboration on data protection and privacy, the Nigeria Data Protection Commission (NDPC) played host to a high-level delegation from Uganda’s Personal Data Protection Office (PDPO) on a strategic understudy visit to Abuja.

The Ugandan delegation, led by Mr Stephen Mugabe, the Director of Data Protection Affairs at the PDPO, was received by the National Commissioner and CEO of the NDPC, Dr Vincent Olatunji, alongside senior officials and department heads of the Commission. The visit is part of Uganda’s broader initiative to enhance its data protection framework by learning from countries within the continent that have made notable strides in the data protection and privacy ecosystem.

In his welcome address, Dr Olatunji expressed delight at receiving the Ugandan team and highlighted the importance of intra-African cooperation in building sustainable and resilient data governance systems. He explained that the Commission’s successes thus far have been facilitated by a deliberate Public-Private Partnership (PPP) model, which fosters collaboration with stakeholders across the sector. “Our approach is the PPP model. We experimented, and it worked. We licensed private sector organisations to carry out Compliance as a service on behalf of the Commission. We started with 15, but we now have 257,” Dr Olatunji stated.

He encouraged the Ugandan data regulators to adopt solutions that reflect their unique national realities, including the deployment of local technologies, engagement with sector stakeholders, and frameworks for capacity development. He advised them not to be afraid to try out innovative ideas. He said, “Don’t be afraid of experimenting. Don’t be afraid of failing”.

The National Commissioner took the opportunity to share Nigeria’s pioneering approach to localising the certification of Data Protection Officers (DPOs), a move designed to ensure contextual relevance and drive indigenous capacity building in the data protection space. This initiative aligns with President Bola Ahmed Tinubu (GCFR)’s broader economic agenda, as it is strategically positioned to enhance investor confidence by demonstrating Nigeria’s commitment to global data protection standards. By strengthening regulatory frameworks and local expertise, the government aims to create a more secure digital environment: this is an essential factor in attracting and sustaining Foreign Direct Investment (FDI) in the country’s growing digital economy.

Leader of the Ugandan team, Mr Mugabe, expressed appreciation for the NDPC’s warm reception and willingness to share operational insights. He provided an update on Uganda’s progress in data protection, noting key milestones such as the establishment of the PDPO and regulatory framework development. He also commended the Commission’s professionalism and commitment to data subject rights, stating that Uganda is working to mirror similar values and structures.

“Our aim with this visit is to understand the daily operations of the NDPC, department by department, and take back lessons that can be adapted to the Ugandan context,” he said. “We are particularly impressed by Nigeria’s approach to awareness, stakeholder engagement, and capacity building”.

The NDPC’s department heads engaged the Ugandan delegation in detailed sessions covering strategic areas such as organisational structure, regulatory compliance, public awareness, enforcement procedures, data breach response, strategic partnerships, and international cooperation.

Dr Olatunji concluded by reiterating the importance of inter-agency and inter-country collaboration. “Data has no borders. As Africa continues to embrace digital transformation, we must ensure our policies, frameworks, and enforcement mechanisms are harmonised to ensure mutual respect, trust, and protection of our citizens’ data rights,” he said. “It is only through such partnerships that Africa can develop a data protection and privacy ecosystem that is not only efficient and secure, but one that the rest of the world will look up to”.

Signed
Itunu Dosekun
Head, Media Unit, NDPC