Nigeria Data Regulator Tightens Privacy Enforcement

The story is largely stable, but the framing has tightened: the NDPC is now explicitly described as enforcing the Nigeria Data Protection Act 2023 across broader data-processing environments, not just schools and named platforms. The current version also generalizes the platform directive and harm language, while adding named officials to the actors involved.

The story has shifted from general privacy enforcement to a more specific, broader NDPC crackdown centered on education institutions and public-image violations on social media. The new version adds concrete compliance demands, a large-scale school review, and the threat of sanctions or prosecution.

• NDPC is reviewing more than 1,000 higher-education institutions.
• Schools must respond within 21 days with audit returns and registration proof.
• Content creators may face possible criminal prosecution for privacy violations.
• NDPC specifically directed TikTok, X, and Meta on unauthorized filming.

The story now places breach notification and incident-response timelines at the center of Nigeria’s privacy enforcement, especially for fintechs under overlapping NDPA and CBN rules. It also shows a more operational, compliance-first enforcement pattern rather than just broad warnings and audits.

The update modestly broadens the enforcement picture by explicitly adding financial services and identifying the Federal Ministry of Education as a partner, while otherwise confirming the previously established active posture.

The story has broadened from general privacy enforcement into a more specific, more active enforcement campaign that now includes electoral data scrutiny and stronger compliance follow-through. It also adds a capacity-building dimension, showing the regulator combining sanctions with training and institutional partnerships.

• Electoral data handling is now under repeated NDPC inquiry.
• NDPC is using settlements and remediation requests as enforcement tools.
• Education institutions face audit deadlines and DPO requirements.
• The regulator is combining enforcement with training and awareness campaigns.
• Temu is now among the named entities.

The story broadens from general privacy enforcement and platform pressure into a more operational compliance regime, adding mandatory breach reporting and a clearer financial-sector reporting channel. It also sharpens the education-sector angle by specifying large-scale audits and registration requirements for schools and universities.

• 72-hour NDPC breach notification is now explicitly required.
• Faster Central Bank reporting applies to financial-sector incidents.
• More than 1,000 schools and tertiary institutions face compliance checks.
• Schools must meet officer-designation and registration requirements.

Nigeria's data protection regime is showing stronger enforcement, with regulators warning content creators over unauthorized filming and expanding compliance checks across schools and other institutions. The main pattern is active use of the Nigeria Data Protection Act 2023, platform pressure, and escalating sanctions for noncompliance.