Nigeria data protection commission investigates over 1000 institutions for data breaches

The Nigeria Data Protection Commission (NDPC) has announced that over 1000 financial institutions, schools, insurance companies, and consultancy firms are currently under investigation for various degrees of data breaches.

This disclosure was made by the Commission’s National Commissioner, Vincent Olatunji, during an interactive session with journalists to mark the first anniversary of the Nigeria Data Protection Commission Act, signed into law by President Bola Tinubu on June 12, 2023. The act aims to advance privacy rights and other fundamental freedoms both in cyberspace and in analogue transactions.

Olatunji revealed that four major banks and three other institutions faced sanctions and incurred fines totaling N400 million for infractions relating to breaches of citizens’ data. He stated, “Cumulatively, we have had over 1,000 reports of data breaches between when we started and now. Out of the 1,000 cases, about 400 are digital revenue companies known as loan sharks. We’ve conducted investigations in sectors including education, finance, real estate, insurance, consulting, and schools, finalizing four major investigations with remediation fees collected.”

He also highlighted the increase in the nation’s data ecosystem value, now surpassing N10 billion due to the multiplier effect of the legislation. “The Data Protection Act 2023 is a major milestone for Nigeria. It has had a significant impact on job creation, tourism, and attracting foreign investments,” Olatunji added.

Ongoing investigations are being conducted concerning data infractions, with the NDPC aiming to raise awareness and improve compliance. “When we started, compliance in the private sector was about 49% while the public sector was 4%. Today, private sector compliance is above 55%, and the public sector has reached 15%,” Olatunji noted.

The NDPC has also taken significant steps to address the activities of illegal digital loan platforms, collaborating with the CBN, ICPC, EFCC, and other regulatory authorities. However, the challenge remains due to the lack of traceable addresses for many of these platforms.

To enhance data management, the NDPC plans to train 10,000 public servants and 1,000 data protection officers and processors, including journalists. “Raising awareness among vulnerable Nigerians about the risks posed by loan sharks is crucial,” Olatunji emphasized.

Nigeria is now at the forefront of global data protection activities, with the country set to host the 2024 All African Data Protection Commissions and Institutions event, attracting about 30 countries.