The Nigeria Data Protection Commission (NDPC) has launched a comprehensive sector-specific investigation targeting organisations suspected of breaching the Nigeria Data Protection Act (NDPA) of 2023. This development was confirmed in a statement issued in Abuja by Mr. Babatunde Bamigboye, Head of Legal, Enforcement, and Regulations at the commission.

Bamigboye stated that the investigation is part of the NDPC’s legal mandate to protect the rights and freedoms of individuals with respect to their personal data, as enshrined in the 1999 Constitution. He emphasized that the NDPA not only reinforces the country’s digital legal infrastructure but also supports Nigeria’s secure and beneficial engagement in both regional and international digital economies through responsible data handling practices.

The initial phase of the investigation will focus on specific industries, including insurance, pensions, gaming, banking, and insurance brokerage sectors. According to Bamigboye, the NDPC has already issued compliance notices to a number of these organisations, whose names will be publicly listed in national newspapers.

As part of the compliance process, these organisations are required to submit, within 21 days, documented proof of several key actions: the filing of their 2024 NDPA Compliance Audit Returns, the appointment or designation of a Data Protection Officer (including full contact details), a summary of technical and organisational data protection measures, and proof of registration as a data controller or processor of major importance.

Bamigboye warned that failure to comply with these directives may result in serious consequences, including enforcement actions, administrative penalties, or even criminal charges, in accordance with the law. He concluded by reaffirming the NDPC’s dedication to fostering a data protection culture rooted in trust, transparency, and accountability, all of which are crucial for strengthening Nigeria’s digital economy and ensuring the privacy rights of its citizens.