Nigerians’ data at risk as NDPC probes 1,369 firms over breach

A bustling digital economy being built since 2020 is at risk as incidents of breaches on data privacy of Nigerians by some financial institutions, online merchants, government agencies and individuals continue to rise, Daily Trust can report. The concern is growing as sensitive personal and financial records—from national identification numbers to bank verification records—are being […]

A bustling digital economy being built since 2020 is at risk as incidents of breaches on data privacy of Nigerians by some financial institutions, online merchants, government agencies and individuals continue to rise, Daily Trust can report.

The concern is growing as sensitive personal and financial records—from national identification numbers to bank verification records—are being exposed, commercialised, or compromised by malicious actors and unauthorized platforms.

This is eroding the public trust required as Nigeria transitions to a digital-first economy. 

Though the Nigeria Data Protection Commission (NDPC) has stepped up efforts as the regulatory watchdog, aggressively deploying legal and administrative frameworks to curb privacy violations and hold data controllers accountable, breaches continue to grow and many Nigerians now fear their data identities aren’t safe. 

The scale of data insecurity in Nigeria first came into sharp focus two years ago when a series of high-profile exposés and cyber incidents were recorded.

In one of the most alarming revelations, digital rights advocates, including the Paradigm Initiative, uncovered unauthorized websites such as XpressVerify and AnyVerify acting as commercial clearinghouses for citizens’ private information.

For a mere N100, individuals could purchase sensitive data—including biometric details and financial records—belonging to registered Nigerians.

This incident highlighted a glaring vulnerability: the exploitation of application programming interfaces (APIs) and the compromised security architecture of foundational government and private databases.

Experts said these breaches do not just violate privacy; they expose citizens to rampant identity theft, financial fraud, and targeted scams.

Further compounding the crisis are threat actors who target interconnected systems for large-scale data exfiltration.

Earlier in 2026, the NDPC flagged thousands of cyberattacks hitting critical Nigerian databases in just a single week. The financial and telecommunications sectors have also faced significant scrutiny.

Following investigations into systemic breaches and unauthorized cross-border data transfers, the NDPC hit major corporate players with massive financial penalties.

The commission imposed a staggering N766.2 million fine on Pay-TV giant MultiChoice Nigeria for unlawful data processing and international data transfers without sufficient legal grounds. 

Similarly, the commission had probed prominent financial institutions like Sterling Bank and Remita Payment Services Limited for alleged data security lapses.

Even global tech platforms have been caught in the crosshairs. The NDPC launched a widespread investigation into e-commerce firm Temu over concerns regarding online surveillance, lack of transparency, and data minimization practices. 

These high-profile cases underscore a sobering reality: data privacy violations are widespread across both local enterprises and multinational tech companies operating within Nigeria.

 

The NDPC’s counter-opffensive

In response to escalating threats, the NDPC, operating under the landmark Nigeria Data Protection Act (NDPA) of 2023, has transitioned from a period of public enlightenment to rigorous enforcement.

Armed with Section 48 of the NDPA, the commission possesses the authority to impose heavy fines, reaching up to 2% of a company’s annual gross revenue, or N10 million—whichever is higher.

The National Commissioner and CEO of the NDPC, Dr. Vincent Olatunji stated that the era of treating citizens’ data as a tradable commodity is over. Olatunji said the commission has adopted a multi-pronged approach to curb the crisis and instill a robust data privacy culture across Nigeria.

The NDPC boss also said the commission had launched large-scale regulatory audits targeting thousands of organisations suspected of violating privacy regulations.

Focusing heavily on high-risk sectors like financial institutions, insurance, and gaming companies, the commission has demanded immediate proof of technical safeguards, the appointment of Data Protection Officers (DPOs), and registration as Data Controllers or Processors of Major Importance (DCPMI).

The NDPC, he said, had instituted strict deadlines for organisations to file their annual Data Protection Compliance Audit Returns (CAR).

He said the NDPC routinely steps in with swift, direct investigations whenever major infrastructure is compromised.

For instance, he said, when a reported data breach threatened the Corporate Affairs Commission (CAC) database, the NDPC swiftly launched a technical probe. Its technical teams assess access control mechanisms, privacy impact assessments, and third-party data processor due diligence to reinforce the guardrails of pivotal databases.

He also said the NDPC’s enforcement goes beyond corporate hacks; it actively protects everyday citizens.

The commission has strongly warned content creators, bloggers, and citizens against taking photos and video footage of unsuspecting members of the general public and sharing them online, categorizing this act as a direct violation of the right to informational self-determination.

However, millions of data subjects still remained vulnerable to unauthorized data processors and malicious cyberattacks. 

 

1,369 companies under probe over data privacy violations 

The NDPC has cracked down on 1,369 Nigerian firms over data privacy violations. The Nigeria Data Protection commission launched a large-scale probe into 1,369 companies to determine their culpability in the data violation allegations leveled against them. Though the companies were not named, a source within NDPC said the majority of them were from the financial sector and government agencies. 

The aim of the investigation is to ensure that data subjects are protected with appropriate technical and organisational measures. The investigation by NDPC covers, among others, the types of personal data involved, the nature and scope of the alleged breach, the risk to data subjects and the mitigation measures carried out where a breach is confirmed.

The commission said it would sanction the companies if found guilty. 

Nigeria Data Protection Regulation (NDPR) mandates FG to collect 2% of annual turnover of any organisation guilty of data breach. 

“We have beamed our searchlight on 40 players in the financial sector. We have written to them to explain why they have not been complying with data regulations and we may sanction them if they ‘re found guilty”,  Olatunji had said.

The NDPC boss said the companies had been given an opportunity to answer why they should not be sanctioned. 

He disclosed that there are over 500,000 data processors organisations in Nigeria, adding that all of them would be monitored on how they handle data of Nigerians.

The Commission’s National Commissioner/CEO also directed that organisations that employ digital payment systems without putting in place appropriate technical and organisational measures as mandated under the Nigeria Data Protection Act, 2023 (NDP Act), will also be examined as part of a wider effort to ensure the integrity of the ecosystem.

 

Data Protection Advisory 

The NDPC has also issued a regulatory advisory to all Data Controllers and Data Processors in response to the escalating threat to data security infrastructure.

The Commission’s technical assessment indicates that some shadowy threat actors have engaged in coordinated operations targeting financial systems and some key digital infrastructure in Nigeria.

It said: “In view of the foregoing, the Commission strongly advises that data controllers and processors (including MDAs) are to urgently step-up their technical and organisational measures to ensure the privacy of all Nigerians and other data subjects in line with the Nigeria Protection Act, 2023 (NDP Act).

“These measures include but are not limited to: Appointment of duly trained and certified Data Protection Officers, development and effectual implementation of Privacy Policies and information security standards, carrying out Data Privacy Impact Assessments and deployment of robust identity and access controls, including Multi-Factor Authentication (MFA).

Others include “Implementation of zero-trust security architecture and network segmentation, immediate remediation of identified system vulnerabilities and continuous patch management, securing cloud infrastructure, APIs, databases, and access credentials, implementation of real-time monitoring, logging, and threat detection mechanisms, implementation of encryption, key management, and secure credential handling, conduct of Vulnerability Assessment and Penetration Testing (VAPT) on critical systems and regular backup, recovery, and resilience testing.”

The Commission said it was prepared to provide requisite regulatory support to organisations in order to ensure adequate level of data privacy and protection.

It said organisations that fail or neglect to implement appropriate measures as required under the Nigeria Data Protection Act, 2023 may incur legal liabilities. 

 

Experts speak

Though Nigerian cybersecurity and legal experts support the Federal Government’s crackdown on data breaches, they urge a shift toward capacity building and systemic prevention over purely punitive fines.

With NDPC enforcing the Nigeria Data Protection Act 2023, experts are analyzing the offensive through several key perspectives.

Iyamu Ezemoya, a lawyer, said to curb data privacy breach in the country, the NDPC should transition from advisory warnings to stringent, active enforcement. 

Though he said the regulatory offensive—such as the massive N766.2 million fine on MultiChoice for non-compliant data practices and data breaches—is necessary and should be extended to other data privacy offenders. He said this is a necessary catalyst to force corporations to take consumer data privacy seriously.

Privacy advocate and cybersecurity analyst, Jinadu Adenle said beyond regulatory offensive, systemic vulnerabilities, such as illegal data trading on the dark web, require deeper technical defenses.