Data Breach: NDPC Probes 240 Cases, Flags 1,900 Organisations

The Nigeria Data Protection Commission (NDPC) is stepping up enforcement of data protection rules, investigating alleged breaches and scrutinising organisations over their handling of Nigerians’ personal information.

The commission’s investigations cover possible violations involving the collection, storage, processing and transfer of personal data, as well as whether organisations have adequate safeguards to protect sensitive information.

Under the Nigeria Data Protection Act 2023, organisations handling personal data are required to comply with applicable privacy obligations and implement appropriate technical and organisational security measures. The law also empowers the commission to investigate suspected violations and take enforcement action where non-compliance is established.

The reported figures of 240 cases under investigation and 1,900 organisations flagged indicate the scale of regulatory scrutiny described in the headline. However, being flagged or investigated does not automatically mean an organisation has committed an offence. Findings depend on the outcome of the commission’s inquiries and the evidence available in each case.

Data breaches can expose individuals to identity theft, financial fraud, impersonation and the unauthorised disclosure of sensitive information. Such incidents can also undermine public confidence in digital services, including banking, telecommunications, online shopping and government platforms.

The NDPC has previously investigated alleged data protection violations involving financial institutions and digital service providers. In April 2026, for example, the commission announced investigations into alleged data breaches involving Remita Payment Services Limited, Sterling Bank and other entities. It said the inquiries would examine the nature and scope of the incidents, the categories of personal data involved, the risks to affected individuals and the measures taken to mitigate the impact.

The commission has also investigated a reported breach involving the Corporate Affairs Commission’s database, highlighting concerns about the security of important public-sector information systems.

Under Nigeria’s data protection framework, organisations are expected to maintain appropriate security controls, manage access to personal information responsibly and respond adequately when incidents occur.

The latest reported enforcement figures reinforce the importance of data protection compliance as Nigeria’s digital economy expands. Organisations that process personal information are expected to take preventive measures, address security weaknesses and cooperate with lawful regulatory investigations.