The Nigeria Data Protection Commission has issued a 21-day compliance notice to banks, insurance firms, pension companies, gaming operators, and insurance brokers suspected of breaching the Nigeria Data Protection Act, 2023.
According to the commission, the notice is part of a sector-by-sector review aimed at enforcing the law, which took effect last year to protect citizens’ data rights and enhance Nigeria’s role in the global digital economy.
“The Nigeria Data Protection Commission, in furtherance of its mandate under the Nigeria Data Protection Act, 2023, has commenced a sector-by-sector investigation of organisations suspected of non-compliance with the provisions of the Act,” the commission said in a statement on Sunday.
The statement, signed by Babatunde Bamigboye, Head of Legal, Enforcement, and Regulations at the NDPC, noted that the notice was issued under sections 5(i), 6(a), 6(c), 46(3), and 47(1)–(2) of the Act. It added that the list of affected organisations will be published in national newspapers on Monday, August 25, 2025.
“These organisations are required to, within 21 days of issuance, provide the following: evidence of filing NDP Act Compliance Audit Returns for 2024, evidence of designation or appointment of a Data Protection Officer, summary of technical and organisational measures for data protection within the organisation, and evidence of registration as a Data Controller or Processor of Major Importance,” the statement read.
The commission warned that organisations failing to comply with the notice could face significant regulatory sanctions.
“Failure to comply with this compliance notice may result in enforcement actions, including the issuance of an Enforcement Order, administrative fines, and/or criminal prosecution in accordance with the NDP Act, 2023,” the statement read.
It said the NDP Act was enacted to “safeguard the fundamental rights, freedoms, and interests of data subjects as guaranteed under the Constitution of the Federal Republic of Nigeria, 1999,” while also providing a legal framework to ensure Nigeria’s “trusted and beneficial participation in regional and global economies through responsible use of personal data.”
The commission has shown its commitment to enforcing the law by imposing substantial penalties on violators. Multichoice Nigeria was recently fined N766.2 million for what the commission described as intrusive, unfair, unnecessary, and disproportionate data practices, including the illegal cross-border transfer of subscriber information.
