The Nigeria Data Protection Commission (NDPC), says in furtherance of its statutory mandate under the Nigeria Data Protection Act (NDP Act) 2023, it has commenced a sector-wide investigation of tertiary institutions across Nigeria to assess compliance with the provisions of the Act.
In a statement by the Head, Legal, Enforcement and Regulations Babatunde Bamigboye said the Commission remains committed to safeguarding the fundamental rights, freedoms, and interests of data, subjects as guaranteed under the Constitution of the Federal Republic of Nigeria, 1999, and to strengthening the legal foundations of Nigeria’s digital economy.
Hello said this is to ensure that the nation’s trusted and beneficial participation in regional and global economies through the responsible use of personal data (Sections 1(a) and 1(h) of the Act).
According to Babatunde, Tertiary institutions, including universities, polytechnics, colleges of education, and other post-secondary institutions, process a significant volume of personal data belonging to students, staff, alumni, research participants, and other stakeholders, calling on the institutions demonstrate full compliance with the NDP Act.
“In accordance with Sections 5(i), 6(a), 6(c), 46(3), and 47(1)–(2) of the NDP Act, the Commission has issued Compliance Notices to certain tertiary institutions. The names of the affected institutions are published in national newspapers on 19 February 2026.
“The affected institutions are required to provide, within twenty-one (21) days of the issuance of the Notice, the following:
1. Evidence of filing NDP Act Compliance Audit Returns for 2024 (Section 6(d)).
2. Evidence of designation or appointment of a Data Protection Officer, including the name and contact details (Section 32).
3. A summary of technical and organisational measures implemented for data protection within the institution (Section 39).
4. Evidence of registration as a Data Controller or Processor of Major Importance (Section 44).
He warned, that failure to comply with the Compliance Notice may result in enforcement actions, including the issuance of an Enforcement Order, the imposition of administrative fines, and/or criminal prosecution in accordance with the NDP Act, 2023.
To strengthen regulatory compliance within the sector under assessment, the National Commissioner/CEO, NDPC, Vincent Olatunji has approved the establishment of a regulatory clinic.
This will promote preventive approach to privacy risks and foster accelerated remediation of identified gaps in compliance.
