Bukola Afeni
The Nigeria Data Protection Commission (NDPC) has issued Compliance Notices to several organisations over alleged non-compliance with the Nigeria Data Protection Act (NDP Act), 2023.
This was contained in a statement signed by the Commission’s Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, who disclosed that a sector-by-sector investigation had begun into organisations suspected of flouting the law.
According to the NDPC, the list of affected organisations drawn from insurance firms, pension companies, gaming operators, banks, and insurance brokers will be published in major national newspapers on Monday, August 25, 2025.
The affected organisations have been directed to, within 21 days, provide evidence of filing their 2024 compliance audit returns, designate a Data Protection Officer, outline their data protection measures, and present proof of registration as a Data Controller or Processor of Major Importance.
The Commission emphasized that the NDP Act, 2023 is designed to safeguard the rights of data subjects and reinforce the legal framework for Nigeria’s digital economy.
It warned that failure to comply with the notice could attract enforcement actions, including administrative fines, enforcement orders, or criminal prosecution.
