The Nigeria Data Protection Commission (NDPC) has issued a Compliance Notice. It announces investigations into suspected non-compliance with the Nigeria Data Protection Act 2023 (NDPA). The NDPC investigation targets organisations in the insurance, pension, gaming, banking and insurance brokerage sectors.
What the NDPC investigation requires
Organisations in those sectors must respond within 21 days of the Compliance Notice, that is by 14 September 2025. Each must provide four things:
- evidence that it has filed its compliance audit returns;
- evidence that it has appointed a Data Protection Officer, with that officer’s name and contact details;
- a summary of the technical and organisational measures it uses to protect personal data; and
- evidence of registration as a Data Controller or Data Processor of Major Importance, where that applies.
These are core NDPA obligations rather than fresh demands. The Act already requires a controller of major importance to register with the NDPC, to appoint a Data Protection Officer, and to file an annual compliance audit. The Notice simply asks regulated firms to show their working.
What happens on non-compliance
The consequences are serious. A firm that fails to respond may face enforcement orders and administrative fines. In some cases, it may also face criminal prosecution.
What every organisation should do
The current sweep is sector-specific. Even so, every data controller and processor should treat it as a prompt. Confirm that your registration status is correct. Check that your Data Protection Officer is in place. Make sure your last compliance audit return was filed on time. Our note on the key updates from the GAID 2025 sets out the wider compliance regime, and our analysis of the right to data portability under Nigerian law shows how far implementation still has to travel.
For further information, please contact: TIF@olaniwunajayi.net