#
Enforcement powers are clearly codified and actively exercised, with multiple significant fines and ongoing investigations within the recent evidence window, plus judicial affirmation of NDPC's regulatory powers.
Sub-modules (6)
Regulator Powers And PenaltiesGreen
Sections 46-48 NDPA grant complaint-investigation, compliance-order and enforcement-order/penalty powers, with penalties up to the greater of NGN10m/NGN2m or 2% of annual gross revenue depending on DCPMI status.
Claims (3):
- A data subject aggrieved by a controller/processor's decision, action or inaction in violation of the NDPA may lodge a complaint with the Commission, which may also investigate on its own accord under Section 46.
- Under Section 47, the Commission may make a compliance order against a data controller or processor it is satisfied has violated or is likely to violate the NDPA or subsidiary legislation.
- Under Section 48, a penalty or remedial fee for a DCPMI may reach the 'higher maximum amount' (the greater of NGN10,000,000 and 2% of annual gross revenue), while a non-major controller/processor faces a 'standard maximum amount' (the greater of NGN2,000,000 and 2% of annual gross revenue).
Enforcement Activity IndexGreen
NDPC has fined Fidelity Bank (NGN555.8m) and MultiChoice Nigeria (NGN766m) and initiated sectoral and specific-incident investigations.
Claims (3):
- NDPC fined Fidelity Bank NGN 555.8 million for data protection violations.
- NDPC fined MultiChoice Nigeria NGN 766 million for unlawful data transfers and privacy rights violations.
- NDPC has commenced a sector-by-sector investigation of compliance with the NDPA and is investigating an alleged data breach at the Corporate Affairs Commission (CAC).
Regulator Funding And CapacityRed
No specific NDPC budget/headcount figures were confirmed in this research pass.
Collective Redress And Class ActionsAmber
No confirmed dedicated class-action mechanism specific to NDPA was located beyond individual civil remedies.
Private Right Of ActionGreen
Data subjects have the right to file civil actions in court against a data controller or data processor on the basis of the NDPA.
Claims (1):
- Data subjects have the right to file civil actions in court against a data controller or data processor on the basis of the NDP Act.
Recent Developments 180DGreen
Within the last 180 days, sources indicate NDPC investigating an alleged CAC data breach and a court ruling backing NDPC's DCPMI registration power.
Claims (2):
- NDPC is reported to be investigating an alleged data breach at the Corporate Affairs Commission (CAC), a development reported in April 2026, within the 180-day recent-developments window of this run.
- A Nigerian court reportedly backed NDPC's power to require registration of Data Controllers/Processors of Major Importance (DCPMIs), reinforcing the Commission's registration and enforcement authority.
Enforcement & Redress
NDPC's enforcement posture remains in active, escalating mode. The Commission fined MultiChoice Nigeria N766,242,500 for unlawful cross-border transfer of Nigerians' personal data and violation of subscribers' and non-subscribers' privacy rights, an action following an investigation opened in the second quarter of 2024, and has now opened a further investigation into an alleged data breach involving Remita Payment Services Ltd., Sterling Bank, and other entities. Both actions sit within the statutory penalty structure set by the Nigeria Data Protection Act 2023: data controllers and processors of major importance face administrative fines of up to N10 million or 2 percent of annual gross revenue, whichever is greater, while other entities face fines of up to N2 million or 2 percent of annual gross revenue. A less-corroborated report suggests NDPC has collected approximately N7.2 billion in aggregate from registrations, compliance revenue and fines, and has concluded 246 investigations with 11 major enforcement actions since intensifying NDPA enforcement; this figure comes from a single lower-tier source and is reported here as an indicative rather than confirmed metric. Over 38,000 organisations are now registered with NDPC as data controllers or processors of major importance, required to appoint data protection officers and file annual Compliance Audit Returns.
Outlook
The Remita/Sterling Bank investigation's outcome, and whether it produces a fine comparable in scale to the MultiChoice action, is the clearest indicator of whether NDPC's enforcement intensity is sustained into the next reporting period.
1 earlier distinct update(s)
Enforcement & Redress
The only dated development falling within this cycle's window for Nigeria's enforcement and redress posture is administrative rather than punitive: the National Data Protection Commission signed a memorandum of understanding with the National Orientation Agency on 6 October 2026, formalising joint data-protection public-awareness work across traditional and digital media. This measure does not alter the Commission's enforcement powers, its penalty structure, or any pending or concluded enforcement matter; it is a public-education and outreach initiative, and is recorded here as context for the Commission's broader regulatory posture rather than as a substantive enforcement development.
The standing enforcement architecture against which this administrative development should be read remains the Nigeria Data Protection Act's penalty structure, which authorises administrative fines of up to NGN10 million or 2% of annual gross revenue, whichever is higher, for data controllers or processors designated as being of major importance, and up to NGN2 million or 2% of annual gross revenue for other organisations. This two-tier structure, which has not changed this cycle, remains the operative framework underpinning the Commission's enforcement capacity, and prior major enforcement matters involving large commercial entities continue to stand as the leading precedents for how that framework is applied, though no new enforcement action falling within this cycle's window was identified.
The pairing of an active, escalating enforcement posture (reflected in the standing penalty tiers and prior major cases) with an administrative public-awareness initiative signed this cycle suggests a regulator pursuing parallel strategies: formal enforcement against significant non-compliance on one track, and broader public and controller education on compliance expectations on another. The MoU with the National Orientation Agency should be read as evidence of the latter track being actively resourced, rather than as any signal of softening on the former.
Outlook
No new enforcement action was identified within this cycle's window, and the standing fine-tier structure under section 48(4) remains the operative penalty framework. The practical output of the NDPC-NOA memorandum of understanding — specific awareness campaigns, published materials, or measurable changes in public reporting of suspected breaches — is the item to watch for in a subsequent cycle, though it is not expected to alter the Commission's underlying enforcement powers or penalty structure.
1 further periodic run re-emitted the standing brief unchanged and is not shown.
Sources and claims (9)
- ProbableOneTrust DataGuidance — A data subject aggrieved by a controller/processor's decision, action or inaction in violation of the NDPA may lodge a complaint with the Commission, which may also investigate on its own accord under Section 46.observed
- ProbableOneTrust DataGuidance — Under Section 47, the Commission may make a compliance order against a data controller or processor it is satisfied has violated or is likely to violate the NDPA or subsidiary legislation.observed
- ProbableNDPC — Under Section 48, a penalty or remedial fee for a DCPMI may reach the 'higher maximum amount' (the greater of NGN10,000,000 and 2% of annual gross revenue), while a non-major controller/processor faces a 'standard maximum amount' (the greater of NGN2,000,000 and 2% of annual gross revenue).observed
- ProbableOneTrust DataGuidance — NDPC fined Fidelity Bank NGN 555.8 million for data protection violations.observed
- ProbableOneTrust DataGuidance — NDPC fined MultiChoice Nigeria NGN 766 million for unlawful data transfers and privacy rights violations.observed
- ProbableOneTrust DataGuidance — NDPC has commenced a sector-by-sector investigation of compliance with the NDPA and is investigating an alleged data breach at the Corporate Affairs Commission (CAC).observed
- ProbableNDPC — Data subjects have the right to file civil actions in court against a data controller or data processor on the basis of the NDP Act.observed
- ProbableOneTrust DataGuidance — NDPC is reported to be investigating an alleged data breach at the Corporate Affairs Commission (CAC), a development reported in April 2026, within the 180-day recent-developments window of this run.observed
- ProbableNDPC — A Nigerian court reportedly backed NDPC's power to require registration of Data Controllers/Processors of Major Importance (DCPMIs), reinforcing the Commission's registration and enforcement authority.observed