The Nigeria Data Protection Commission (NDPC) has begun a sector-wide investigation of tertiary institutions across Nigeria to evaluate compliance with the provisions of the Nigeria Data Protection Act (NDP Act 2023).
This was announced in a statement issued on Thursday by the Head of Legal, Enforcement, and Regulations at the NDPC, Babatunde Bamigboye, adding that the exercise was in line with its statutory mandate under the NDP Act 2023 to enforce data protection standards in Nigeria across sectors.
He said, “In line with the objectives of the Act, the Commission remains committed to safeguarding the fundamental rights, freedoms, and interests of data subjects as guaranteed under the Constitution of the Federal Republic of Nigeria, 1999, and to strengthening the legal foundations of Nigeria’s digital economy while ensuring the nation’s trusted and beneficial participation in regional and global economies through the responsible use of personal data (Sections 1(a) and 1(h) of the Act).
“Tertiary institutions, including universities, polytechnics, colleges of education, and other post-secondary institutions, process a significant volume of personal data belonging to students, staff, alumni, research participants, and other stakeholders. It is therefore imperative that these institutions demonstrate full compliance with the NDP Act.”
The NDPC cited Sections 5(i), 6(a), 6(c), 46(3), and 47(1)–(2) of the Act, stating it had forwarded Compliance Notices to specific tertiary institutions, with their names published in national newspapers on February 19, 2026.
The institutions have been given 21 days from the date of issuance of the Compliance Notice to provide certain documentation, such as evidence of filing NDP Act Compliance Audit Returns for 2024 under Section 6(d), evidence of designation or appointment of a Data Protection Officer in line with Section 32, amongst other documents.
The Commission said, “Failure to comply with the Compliance Notice may result in enforcement actions, including the issuance of an Enforcement Order, the imposition of administrative fines, and/or criminal prosecution in accordance with the NDP Act, 2023.
Bamigboye stated that the National Commissioner/CEO of the NDPC, Dr. Vincent Olatunji, has approved the establishment of a regulatory clinic with the view of strengthening regulatory compliance of the sector under assessment.
