The Nigeria Data Protection Commission (NDPC) has issued a public notice announcing the commencement of sector-by-sector investigations into organisations suspected of non-compliance with the provisions of the Nigeria Data Protection Act 2023 (NDPA). A total of 1,368 organisations are listed and are now required to present evidence of compliance with the NDPA within twenty-one (21) days.
Affected sectors, as indicated in the notice, include insurance, pension, gaming and banking (financial institutions). The affected organisations include 795 financial institutions, 35 insurance companies, 392 insurance brokers, 136 gaming companies and 10 pension companies. These organisations are required to present the following to the NDPC as evidence of compliance on or before the expiration of the twenty-one (21) day deadline:
- i. evidence of filing NDPA Compliance Audit Returns for 2024;
- ii. evidence of designation or appointment of a Data Protection Officer (DPO), including name and contact details of the DPO;
- iii. a summary of technical and organisational measures for data protection deployed within the organisation; and
- iv. evidence of registration as a Data Controller or Processor of major Importance.
The NDPC has further warned that a failure to comply with the compliance notice may result in enforcement action including issuance of enforcement orders, administrative fines, and/or criminal prosecution in accordance with the NDPA.
Next Steps:
Organisations above or associated companies (including data controllers to the above companies) would need to ensure compliance with the above request. Where these information/documents are not available, it would be relevant to get these sorted within (twenty-one) 21 days. Whilst specific organisation and sectors have been identified above, other organisations and sectors may need to look inward, in order to put their respective data governance practices in order.
For more information on meeting the NDPC compliance requirements, please contact us at tmtpractice@aluko-oyebode.com.
