The Nigeria Data Protection Commission (NDPC) has initiated in-depth investigations into 1,369 organizations, including key fintech players, over potential violations of the Nigeria Data Protection Act (NDPA) 2023. The affected group comprises banks, insurance firms, pension companies, gaming operators—and notably, several financial services platforms such as Moniepoint, Abeg, and eTranzact, which fall under the fintech and payment service categories. Unfortunately, official public confirmation of each company's inclusion isn’t explicit—however, they operate within the sectors NDPC has targeted.
The probe demands that these organizations provide, within 21 days, clear proof of their compliance. Required documentation includes their 2024 data protection audit returns, appointment details of Data Protection Officers, summaries of technical and organizational security measures, and evidence of registration as significant data controllers or processors.
This sector-wide operation builds on earlier enforcement actions, like the ₦766 million fine imposed on MultiChoice Nigeria for unlawful cross-border data transfers and subscriber data violations. Such cases reaffirm the NDPC’s intent to uphold data privacy through tangible consequences.
Financial and fintech firms manage vast volumes of personal data, from bank details and ID numbers to transactional histories, making robust data governance essential. The heightened focus signals the NDPC’s agenda to cement trust in Nigeria’s digital economy and align with the country's constitutional protections under Section 37.
Failure to comply with NDPC directives may lead to enforcement orders, significant fines, or even criminal prosecution. The NDPA allows penalties of up to ₦10 million or 2% of a company’s gross annual revenue, depending on the severity of the violation. Beyond financial penalties, businesses face reputational damage and risks to operational continuity.
Photo credit: Unsplash
0 Comments