In a move to crack down on data breaches, the National Data Protection Commission (NDPC) in Nigeria has initiated an investigation into banks and telecommunications companies. These entities face the risk of paying substantial fines, potentially reaching billions of naira.
The NDPC has received numerous complaints over the past few weeks, primarily concerning unlawful data processing, unauthorized access to personal information, and violations of data subjects’ rights. These grievances have prompted the commission to take action against the alleged offenders.
Under the recently enacted Data Protection Act 2023, data controllers with an annual turnover of 200 billion naira or more may be fined up to 2 billion naira, equivalent to 2 per cent of their gross revenue. In addition to the hefty fines, individuals found guilty of data breaches may face imprisonment for up to one year.
The NDPC is currently investigating major commercial banks, including GT Bank, Fidelity Bank, Unity Bank, Zenith Bank, as well as Leadway Insurance and Babcock University, among others. It has come to light that several microfinance banks have not yet aligned their operations with data privacy and protection standards.
The scrutiny has extended to online lenders, commonly known as “Loan Sharks.” The Federal Competition and Consumer Protection Commission has mandated these lenders to obtain privacy compliance and clearance from the NDPC before granting approval. The NDPC is currently investigating more than 400 complaints related to the online lending sector.
Soko Loan, one of the online lending platforms, is making efforts to re-enter the digital lending market. However, it awaits approval from the NDPC before resuming operations.
The leadership of the NDPC has emphasized the importance of raising awareness about data protection rules and regulations. While enforcement is necessary, the commission aims to prioritize educating entities about compliance. To achieve this, certain banks, a state government agency, and other data controllers have undergone a remediation process to ensure adequate compliance.
