Overview
Introduction On Monday, August 25, 2025, the Nigeria Data Protection Commission (NDPC) published in BusinessDay Newspaper, a list of entities (“the 2025 List”) under investigation across various sectors for non-compliance with mandatory obligations under the Nigeria Data Protection Act (NDP Act) 2023, including the registration of data controllers and processors of major importance, the appointment of Data Protection Officers (DPOs), and filing of Data Protection Compliance Audit (CAR) reports. This action marks a watershed moment in Nigeria's data protection enforcement landscape, demonstrating that the NDPC is now employing a dual strategy of administrative sanctions (fines, investigations, compliance directives) and public enforcement tools (naming and shaming) to ensure compliance with data protection laws by relevant entities.
Against this backdrop, this article examines the NDPC's enforcement architecture, the legal implications of being listed, and the related business and reputational risks. It also reviews precedent cases, such as the NDPC fine on Fidelity Bank and the investigation and fine imposed on Meta by the FCCPC and NDPC and offers practical compliance strategies for Nigerian entities.
