The Nigeria Data Protection Commission (NDPC) said it has begun a sector-wide investigation into companies suspected of flouting the country’s new data protection law, marking one of the first major enforcement steps since the legislation took effect.
The data protection regulator said it has issued compliance notices to organisations across banking, insurance, pension and gaming sectors, requiring them to show evidence they are meeting provisions of the Nigeria Data Protection Act, 2023.
It disclosed this on Monday in a press release signed by Babatunde Bamigboye, its head of legal enforcement and regulations.
The regulator directed the companies to submit within 21 days proof of their compliance, including filing audit returns, appointing data protection officers, and registering as data controllers or processors of major importance.
“In line with Sections 5(i), 6(a), 6(c), 46(3), and 47(1)-(2) of the NDP Act, the Commission has issued Compliance Notices to certain organisations listed in the schedule of its notice. The list of these organisations was published today, 23rd August 2025, in some major newspapers across the country. The list of organisations were drawn from insurance companies, pension companies, gaming companies, banks, and insurance brokers.
“The Commission reiterates that failure to comply with this Compliance Notice may result in enforcement actions, including the issuance of an Enforcement Order, administrative fines, and/or criminal prosecution in accordance with the NDP Act, 2023,” it said.
The NDPC said the move was part of efforts to safeguard citizens’ rights and strengthen the foundations of Nigeria’s digital economy.
Nigeria passed the data protection law in June 2023, giving legal backing to safeguards over the collection, processing and storage of personal information.
The regulator said enforcement is key to strengthening the legal foundations of Nigeria’s digital economy and ensuring the country’s trusted participation in regional and global markets through responsible use of personal data.
READ ALSO: Chams’ SIM card business hits N5 billion turnover three years into launch
“The NDP Act, 2023, seeks to safeguard the fundamental rights, freedoms, and interests of data subjects as guaranteed under the Constitution of the Federal Republic of Nigeria, 1999,” the notice reads.
It also seeks to “strengthen the legal foundations of Nigeria’s digital economy while ensuring the nation’s trusted and beneficial participation in regional and global economies through responsible use of personal data.”
Banks, insurers and pension firms hold large volumes of sensitive customer data, from account details to biometric records, making compliance central to maintaining trust in financial services.
