The Nigeria Data Protection Commission (NDPC) has initiated formal investigations into global platforms TikTok and Truecaller, citing suspected data breaches. This announcement, made by National Commissioner and Chief Executive Officer Vincent Olatunji at a press conference in Abuja, signals a robust push towards enforcing the Nigeria Data Protection Act.
“As we speak, we have even gone to the extent of investigating multinationals. We are currently investigating TikTok and Truecaller in the area of data privacy,” Olatunji disclosed, emphasizing the commission’s commitment to holding even prominent international entities accountable. The investigation aims to assess these platforms’ adherence to Nigerian data protection laws, with potential regulatory actions pending the findings.
Our personal data, often shared without a second thought, is now under the regulatory microscope. I’ve often wondered, as many of you likely have, just how much of our information these apps truly hold. The NDPC is essentially asking the same question, but with the authority to demand answers and enforce change.
Olatunji’s revelation that initial compliance rates were a mere 4%, now soaring to over 55% due to increased enforcement, underscores the NDPC’s evolving impact. “Depending on our findings, if they are able to go through remediation and do what is right, we are happy to work with them,” he stated, illustrating a preference for collaborative improvement over immediate punitive measures.
The NDPC’s strategy, as detailed by Olatunji, involves a remediation approach, where breaches are assessed based on severity, scale, and economic impact. This method, rather than immediate sanctions, allows companies to rectify shortcomings under close monitoring. Breaches lead to mandatory record-keeping of data processing activities and a six-month to one-year monitoring period.
To further aid organizations in navigating the complexities of data protection, the NDPC introduced the Nigeria Data Protection Act – General Application and Implementation Directive. This comprehensive guideline, made accessible via the NDPC portal, is designed to clarify regulations and reinforce the role of Data Protection Officers.
Olatunji acknowledged that inadvertent breaches often stem from a lack of understanding. “Many organizations do not fully understand data protection regulations,” he explained, highlighting the directive’s role in bridging this knowledge gap.
Read Also: SEC to Publicly Name and Shame Capital Market Offenders in New Compliance Drive
The directive covers crucial areas such as data protection principles, lawful data processing bases, data subjects’ rights, cross-border data transfers, and standardized grievance mechanisms. Additionally, the commission has introduced the Standard Notice to Address Grievance, empowering individuals to directly demand corrective action from data controllers.
The full implementation of the directive is slated for September 2025, providing a six-month transition period, with fee-related provisions taking effect in January 2026. The NDPC has also committed to ongoing guidance, capacity-building programs, and feedback mechanisms to ensure continuous improvement in data privacy and protection.
This initiative is rooted in Section 37 of Nigeria’s 1999 Constitution, which guarantees citizens’ privacy, aligning with President Bola Tinubu’s assent to the Nigeria Data Protection Bill on June 12, 2023. The NDPC’s extensive stakeholder engagements, including data subjects, government agencies, and international institutions, reflect a collaborative effort to shape a robust data protection landscape.
In an era where digital interactions are increasingly prevalent, the NDPC’s actions are not merely regulatory; they are a critical step towards securing our digital trust and ensuring that our personal data remains protected. As Olatunji reiterated, the commission is committed to “safeguarding the privacy rights of Nigerians through the implementation of the Nigeria Data Protection Act – General Application and Implementation Directive.”
