Cybersecurity Policy Report, Nigerian Regulator to Conduct Privacy Law Compliance Investigations, (Aug 25, 2025)

By Tony Foley

The Nigerian Data Protection Commission (NDPC) has commenced what it is calling a “sector-by-sector investigation” into organizations suspected of noncompliance with the Nigerian Data Protection Act (NDPA).

In a LinkedIn post, the NDPC said it had issued compliance notices under the NDPA to a variety of organizations, a list of which was published on Aug. 23 in major newspapers in Nigeria. The post does not reproduce the list of organizations receiving a notice but notes that it includes insurance companies, pension companies, gaming companies, banks, and insurance brokers.

Each organization, within 21 days of receipt of a compliance notice, must provide evidence of filing NDPA compliance audit returns for 2024, evidence of designation of a data protection officer, including name and contact details, a summary of technical measures for data protection within the organization, and evidence of registration as a data controller or processor of major importance.

NDPC added that failure to comply with a compliance notice could result in enforcement actions, including the issuance of an enforcement notice, administrative fines, or criminal prosecution.

News: InternationalLegislation LitigationEnforcement DataPrivacy DataSecurity