Nigeria’s Data Regulator Enters Full Enforcement Mode: What Changes Now?

Nigeria’s data-protection regulator is no longer content to be seen as a public-awareness body explaining privacy obligations to businesses. It wants organisations to understand that the country’s data-protection law carries consequences and that registration, audits and governance procedures are not optional formalities.

The Nigeria Data Protection Commission (NDPC) has described its next phase as “full enforcement” of the Nigeria Data Protection Act 2023 and its General Application and Implementation Directive 2025. Its 2025 annual report sets out the shift while also emphasising a restorative rather than exclusively punitive approach to investigations.

The numbers are substantial. In early 2026, the Commission’s leadership was reported to have said that it had concluded 246 investigations into alleged privacy violations and that regulations and sanctions had generated more than ₦5.2 billion in revenue. The same account cited 11 major enforcement actions, including financial penalties and corrective directives.

A separate legal-sector analysis published in July 2026 estimated that the Commission had collected approximately ₦7.2 billion from registrations, compliance revenue and fines combined. That figure is an estimate from a legal adviser, not a directly interchangeable measure of the ₦5.2 billion reported in connection with regulations and sanctions.

These figures indicate an enforcement system operating at considerable scale. But they do not, by themselves, establish how many Nigerians have received effective remedies, whether compliance is improving across the economy or whether the regulator is applying its powers consistently.

That is the more important story. Nigeria is moving from the establishment of a modern privacy regime towards its practical enforcement. The next test is whether the system can deliver accountability that is transparent, proportionate and consistent—whether the organisation processing personal data is a multinational company, a local technology business or a government institution.

The foundation is the Nigeria Data Protection Act 2023, which established the NDPC as the country’s principal data-protection regulator and set out rights for individuals alongside obligations for organisations that process personal information.

The law requires organisations to consider the purpose and lawful basis of processing, protect personal data, respect data-subject rights and maintain appropriate accountability measures. Depending on the nature of their operations, organisations may also face registration requirements, compliance audits and obligations relating to security incidents and international transfers of personal data.

The NDPC’s General Application and Implementation Directive 2025 (GAID) provides further operational detail. Together, the Act and the Directive give the Commission a more developed framework for assessing how organisations handle personal information.

The regulator’s 2025 annual report describes a progression from awareness and implementation towards fuller enforcement. This is not merely a communications shift. It changes the risk calculation for organisations that previously treated privacy compliance as a policy document, a registration exercise or an annual filing handled at the last minute.

The Commission’s reported investigation record reinforces that message. According to figures attributed to its leadership in early 2026, 246 investigations had been concluded, resulting in 11 major enforcement actions. These numbers should be read carefully: an investigation is not necessarily a proven violation, and the number of concluded investigations is not the same as the number of penalties imposed.

Still, the direction is clear. The NDPC is using investigations and enforcement measures to make data protection a more visible part of Nigeria’s regulatory environment.

The phrase can suggest that every case will now end in a fine. That is not what the Commission’s own account says.

In its annual report, the NDPC explicitly describes its approach as restorative rather than punitive. The report points to provisions of the Act that permit warnings, non-penal compliance orders, remedial fees and consideration of circumstances such as limited privacy impact and cooperation during investigations.

That distinction matters. A credible regulator should not treat every compliance failure as identical. A minor administrative omission that is promptly corrected is different from a systemic practice that exposes large numbers of people to unnecessary data collection, discriminatory treatment or unlawful transfers.

A restorative approach can encourage organisations to fix the underlying problem, strengthen their controls and prevent recurrence. It can also reduce the risk of enforcement becoming a revenue-generating exercise disconnected from the harm experienced by individuals.

But restoration must not become a euphemism for weak consequences. Where violations are serious, persistent or accompanied by a refusal to cooperate, enforcement needs to be sufficiently strong to deter repetition. The public should also be able to understand why a regulator chose a warning in one case and a substantial penalty in another.

The real measure of “full enforcement mode” is therefore not the number of fines alone. It is whether the regulator can demonstrate that its responses are evidence-based, proportionate to the circumstances, consistently applied and effective in preventing further harm.

The most visible example remains the NDPC’s penalty against MultiChoice Nigeria.

In June 2025, the Commission imposed an administrative penalty of ₦766,242,500 following an investigation launched in the second quarter of 2024. The action was publicly reported in July 2025. The NDPC said its investigation found violations involving subscribers’ privacy rights, the processing of personal data belonging to people who were not subscribers, and the transfer of Nigerians’ personal data across borders without appropriate legal safeguards.

The case matters because cross-border data movement is a routine feature of modern digital services. Customer-support systems, cloud infrastructure, analytics platforms, payment services and corporate technology stacks can involve data being accessed or processed in multiple jurisdictions.

That does not make every international transfer unlawful. Under the Nigeria Data Protection Act, organisations must satisfy the applicable requirements for international transfers, including appropriate protection mechanisms or a relevant statutory exception. They must be able to explain the legal basis for the transfer and demonstrate that the required safeguards are in place.

For businesses, the lesson is that data protection cannot stop at the boundary of the Nigerian subsidiary. An organisation needs to understand what happens to personal data after it is collected, which vendors and affiliated entities can access it, where processing occurs and what legal arrangements support those flows.

The case also highlights a less obvious issue: privacy obligations can extend to individuals who are not direct customers. A company may process information about a subscriber’s contacts, family members or other associated people. The absence of a direct commercial relationship does not automatically remove those individuals’ rights.

The MultiChoice action therefore illustrates the potential financial and reputational exposure created by weak data governance. It is evidence that enforcement can have serious consequences for a major business. It is not, on its own, proof that the entire regulatory system is now consistently enforced.

Another important development came on 28 July 2026, when the Federal High Court ruled in Emmanuel Harunna v. Nigeria Data Protection Commission (FHC/L/CS/1116/2024).

According to legal reporting, the court dismissed a challenge to the Commission’s authority to register Data Controllers and Data Processors of Major Importance (DCPMIs), including in relation to Point of Sale agents.

The decision provides support for the NDPC’s registration regime and its authority to determine which organisations fall within the relevant category. That matters in a digital economy where small businesses, agents and intermediaries may handle personal information as part of wider payment, identity and financial-services networks.

Registration is not simply a fee-paying exercise. Properly designed, it gives a regulator a clearer picture of who is processing personal data, which organisations have significant exposure and where supervision may be necessary.

Yet registration should be the beginning of accountability, not its end. An organisation can appear on a register and still have weak security, excessive collection practices or poor complaint-handling procedures. Equally, an organisation’s failure to understand whether it falls within a category should not become a permanent excuse for neglecting the underlying duties imposed by law.

The court ruling supports the Commission’s legal authority. The larger question is how effectively the resulting oversight improves the way data is handled in practice.

The headline numbers have attracted attention, but they require a distinction that is important for both public accountability and sound analysis.

In early 2026, the NDPC’s reported figures included more than ₦5.2 billion in revenue associated with regulations and sanctions, alongside 246 concluded investigations and 11 major enforcement actions. A separate July 2026 legal-sector article estimated approximately ₦7.2 billion in cumulative collections from registrations, compliance revenue and fines.

Those figures should not be combined or described as though they measure the same thing. Registration fees and compliance-related charges are not the same as penalties imposed after a finding of non-compliance. Nor does revenue generated by the regulatory system tell us how many people have received compensation or how many organisations have changed problematic practices.

The distinction is important because regulatory performance can be measured in several ways: the number of investigations completed, the quality and timeliness of decisions, the amount of penalties imposed, the proportion of organisations meeting their obligations, the resolution of complaints and the reduction of recurring violations.

A large revenue figure may reflect a growing compliance ecosystem. It does not automatically establish that privacy rights are better protected.

The NDPC’s 2025 annual report separately reported ₦4.99 billion in compliance revenue for that year, according to a September 2026 policy analysis by the African Centre for Technology Policy. That figure is another distinct measure and should not be treated as equivalent to the cumulative estimates for fees, sanctions and fines.

For the regulator, publishing clear, reconciled figures would help. A public reporting framework that distinguishes registration revenue, audit-related fees, remedial payments, administrative penalties and completed investigations would allow businesses, policymakers and citizens to evaluate performance more accurately.

The public-sector accountability test

The most difficult question for the NDPC may not be how it deals with large private companies. It may be whether it can demonstrate that public institutions face credible scrutiny as well.

In February 2026, the Foundation for Investigative Journalism reported examples of public institutions that had exposed staff information online, including personal details contained in curriculum vitae. The investigation argued that enforcement actions had been much more visible against private entities than against government agencies.

The report also cited the NDPC leadership’s assessment that public-sector compliance remained significantly lower than private-sector compliance, despite some improvement. Those figures were reported in early 2026 and should not be treated as a verified October 2026 compliance rate.

The underlying concern is serious. Government bodies can process some of the most consequential personal information in the country: identity records, employment files, health information, education records, tax information and details linked to access to public services. The consequences of poor data handling can extend well beyond commercial inconvenience.

A privacy framework that disciplines private companies but fails to demonstrate meaningful accountability in the public sector risks undermining confidence in the law itself. Citizens may reasonably ask why a company faces a major penalty while a public body that exposes personal information appears to face a different standard.

There is, however, an important development on the government side. In August 2026, the Federal Government confirmed a directive issued through Circular No. 59805/S.I/74, dated 27 July, requiring ministries, departments and agencies to comply with the Nigeria Data Protection Act and related rules. The circular directs institutions to designate qualified Data Protection Officers, communicate their details to the NDPC, engage licensed compliance organisations where required, budget for compliance and submit mandatory audit returns. Permanent secretaries, accounting officers and chief executives were made responsible for ensuring institutional compliance.

This is a significant administrative signal. It recognises that public bodies are data handlers with legal responsibilities, not exceptions to privacy protection.

But a circular is not the same as proof of compliance. The next evidence should be visible in implementation: appointments, budgets, completed audits, corrected exposures, complaint outcomes and, where warranted, enforcement action. The question is not whether government has issued instructions. It is whether those instructions change behaviour.

A second issue concerns the relationship between regulatory authority and institutional incentives.

Nigeria’s data-protection framework gives the NDPC powers to charge prescribed fees, investigate violations and impose penalties. The Commission’s funding arrangements also permit it to retain certain revenues, including levies, fees, penalties and fines, under the governing framework.

A September 2026 policy analysis by the African Centre for Technology Policy argues that this model deserves scrutiny. Its concern is structural: when a regulator retains revenue generated by its own compliance and enforcement activities, transparency and independent oversight become especially important.

That does not establish that the NDPC is imposing penalties to increase revenue. Such a conclusion would require evidence about the Commission’s decisions and motives. But the institutional design creates a legitimate governance question: how can the public be confident that penalties are determined by the seriousness of a violation rather than by their financial value?

The answer lies in transparent enforcement criteria, reasoned decisions, accessible appeal mechanisms, independent scrutiny and clear separation between the assessment of violations and the budgeting of the regulator.

Organisations should be able to understand the factors that influence penalties, including the scale of the breach, the number of people affected, the duration of the conduct, the degree of cooperation and the corrective steps taken. Individuals should be able to see that complaints are considered fairly and that the regulator can explain the outcome.

Trust is not the opposite of enforcement. It is one of the conditions that makes enforcement legitimate.

For businesses operating in Nigeria, the regulatory direction is clear enough to justify action, even when a specific investigation or penalty has not been announced.

First, map personal data flows. Organisations should know what information they collect, why they collect it, who can access it, how long it is retained and where it is processed. This should include data handled by vendors, cloud providers and affiliated companies.

Second, review legal bases and notices. Consent is not the only possible lawful basis for processing personal data, but organisations must be able to identify and justify the basis they rely on. Privacy notices should explain practices accurately rather than merely reproduce generic language.

Third, treat international transfers as a governance issue. Businesses should document their transfer arrangements, identify the safeguards or statutory exceptions relied upon and check that vendor contracts match actual processing practices.

Fourth, make registration and audit obligations operational. Organisations should determine whether they qualify as DCPMIs or DCPMIs under the applicable framework, confirm their current registration status and meet the relevant compliance-audit requirements. They should verify current deadlines and filing procedures directly with the NDPC, rather than relying on outdated third-party summaries.

Fifth, prepare for incidents and complaints. A documented response process should identify who investigates a suspected breach, who makes notification decisions, how affected people are supported and how corrective actions are tracked. Staff should know how to escalate concerns.

Finally, make privacy governance part of management oversight. A Data Protection Officer cannot be effective if the role exists only on paper. Senior leadership needs visibility into material risks, audit findings, vendor arrangements, unresolved complaints and remediation progress.

These steps are not a guarantee against enforcement. They are a practical way to demonstrate that privacy is being managed as an ongoing legal and operational responsibility.

The next phase should be measured in outcomes, not fines

Nigeria has established a more mature legal framework for data protection, and the NDPC is increasingly using the powers available to it. Its reported investigation figures, the MultiChoice penalty, the court ruling on registration and the government’s compliance directive all indicate a system moving beyond public awareness alone.

But the number of investigations concluded, the amount of revenue collected and the value of a high-profile fine cannot answer every question about the system’s effectiveness.

The more meaningful measures will be whether organisations improve their practices, whether data subjects can obtain redress, whether violations decline, whether enforcement decisions are consistent and whether public institutions face the same scrutiny as private companies.

The Commission’s own emphasis on restorative enforcement offers a useful starting point: compliance should result in safer practices, not merely payments to a regulator. Serious violations must still carry credible consequences, but the ultimate objective is to prevent harm and protect people.

Nigeria’s “full enforcement mode” will become meaningful when accountability is visible across the economy—not only when the largest fines make headlines. The regulator’s next challenge is to show that the law protects people as consistently as it regulates organisations.