Follow Us on Google
Nigeria’s war against reckless data misuse has entered a fierce new phase. The Nigeria Data Protection Commission (NDPC) says 2025 is already its busiest year on record, with loan shark complaints flooding in at an average of three a day.
At the centre of the storm is the Nigeria Data Protection Act, signed into law in June 2023. The law was pitched not only as a shield for citizens’ privacy but also as a driver of jobs, investment, and trust in the digital economy.
“It [the Act] will safeguard the rights of Nigerians, create jobs, empower the economy, improve global competitiveness and reshape Nigeria’s reputation as a safe place for foreign investment,” NDPC Director General, Dr. Vincent Olatunji, said in an interview on Tuesday.
The Commission spent its first year building awareness and capacity. Now, Olatunji says, it has entered “the era of enforcement.” In 2025 alone, NDPC has opened probes into 1,369 organisations across banking, pensions, insurance, and gaming. Some cases have ended with fines, others with remediation, and minor breaches, such as privacy disputes on WhatsApp groups, have been settled through mediation.
The biggest hammer yet fell on MultiChoice, which was fined N766.2 million ($508,000) for lack of transparency in its privacy policies and lapses among its agents.
But loan sharks remain the real headache. “On digital lending companies alone, or what we call loan sharks, we receive an average of three every day,” Olatunji revealed. “That’s almost 100 in a month.”
Complaints range from invasive debt collection to outright data abuse. Each case begins with a Pre-Action Conference, giving the accused firms a chance to respond. If they show willingness to comply, the Commission imposes remediation and six months of monitoring. Those who refuse correction face heavy penalties.
For Olatunji, this graduated approach ensures fairness while forcing compliance. “We don’t want fines to be seen as just another cost of doing business,” he explained.
The Commission has also tackled the deep capacity gap that existed when the law took effect. Nigeria had fewer than 1,000 certified data protection officers in 2023; today it boasts over 7,000. Registered processors have surged from 630 to more than 36,000, while 4,800 major controllers have filed annual audit reports.
The compliance ecosystem has become a small industry of its own. Some 275 licensed Data Protection and Compliance Organisations (DPCOs) now employ tens of thousands, with 23,000 jobs directly tied to data privacy. In 2024 alone, the sector delivered more than $1.5 million in revenue to the government through registrations and fines.
NDPC has also pioneered a Virtual Privacy Academy (VPA) that uses dramatised case studies to teach Nigerians the meaning of consent, transparency, and responsible data use. “This is the first of its kind globally,” Olatunji said proudly. “It is one of our innovative ways of promoting privacy.”
Despite the gains, problems persist. Many firms continue to misrepresent the data they collect or hide how it is used. Consent violations—apps harvesting personal details without approval, unmarked CCTV surveillance—remain widespread. “These are the kinds of daily violations we are tackling,” Olatunji admitted.
Even the financial sector, despite its sophistication, has been found wanting. Yet public awareness is growing fast. “People are more aware of their rights now as data subjects,” Olatunji said.
“Controllers and processors are more aware of their obligations.”
The progress has not gone unnoticed. Regulators from six African countries, including South Africa, Tanzania, and Mozambique, are in Nigeria studying NDPC’s model of rapid transition from law to enforcement.
For Olatunji, the ultimate prize is trust. “Nigeria is now being seen as a country that is serious about digital business and where your rights will be protected because of the law we have in place and an independent data protection authority,” he said.
With daily breaches piling up, NDPC’s job is far from done. But in just two years, the Commission has become the backbone of Nigeria’s digital future, one that is trying to keep loan sharks and data abusers firmly in check.
