Data privacy: NDPC begins probe of over 1,000 education institutions

From Adanna Nnamani, Abuja

The Nigeria Data Protection Commission (NDPC) has commenced an investigation into over 1,000 education institutions across the country over compliance with the Nigeria Data Protection Act (NDP Act), 2023.

The move affects federal, state, and private universities, polytechnics, colleges of education, and technical colleges, marking one of the largest sector-wide compliance checks since the enactment of the law.

In a public notice issued by its Head, Legal, Enforcement and Regulation, Babatunde Bamigboye, on Thursday, the Commission said the probe forms part of its ongoing sector-by-sector enforcement drive aimed at safeguarding the fundamental rights and freedoms of data subjects, as well as strengthening the legal foundation of Nigeria’s digital economy through the trusted use of personal data.

The NDPC directed the affected institutions to submit, within 21 days, evidence of filing their 2024 Data Protection Compliance Audit Returns, proof of designation or appointment of a Data Protection Officer, including relevant contact details, and a summary of technical and organisational measures adopted to protect personal data within their establishments. It also requested evidence of registration as a Data Controller or Processor of Major Importance as required by law.

The Commission warned that failure to comply with the notice may result in the issuance of enforcement orders, imposition of administrative fines, and possible criminal prosecution in accordance with the provisions of the NDP Act, 2023. It stressed that compliance is mandatory and not optional for institutions that process large volumes of personal data.

Observers note that the education sector remains one of the biggest handlers of sensitive personal information in the country, including students’ academic records, admission details, biometric data, financial information, and staff records. With increasing digitalisation of admissions, online learning platforms, and electronic documentation systems, concerns over data breaches and weak privacy safeguards have grown in recent years.

The Commission maintained that the investigation is in line with its statutory mandate under relevant sections of the Act empowering it to monitor, investigate, and enforce compliance across sectors.