The Nigeria Data Protection Commission (NDPC) has detailed strict compliance requirements for tertiary institutions currently under investigation as part of its ongoing sector-wide enforcement of Nigeria’s data protection laws.
The Commission said the affected universities, polytechnics, colleges of education, and other tertiary institutions have been formally directed to regularise their data protection practices in line with the provisions of the Nigeria Data Protection Act (NDPA) 2023.
21-Day Submission Deadline
As part of the compliance exercise, the NDPC directed the institutions under probe to submit, within 21 days, specific documents and evidence demonstrating adherence to statutory data protection obligations. These include:
- Evidence of filing their 2024 Data Protection Compliance Audit Returns
- Proof of designation or appointment of a Data Protection Officer (DPO), including valid contact details
- A summary of technical and organisational measures deployed to secure and protect personal data
- Evidence of registration as a Data Controller or Data Processor of Major Importance, as required by law
The Commission emphasised that these requirements are not optional and apply strictly to institutions that process large-scale personal data.
Focus on Sensitive Student Data
According to the NDPC, tertiary institutions routinely process sensitive categories of personal data, including student academic records, biometric data, medical information, financial details, and disciplinary records. The Commission noted that such data often relates to minors and young adults, making strong data protection controls essential.
The NDPC warned that failure to meet the stipulated requirements within the given timeframe may attract enforcement actions, including regulatory orders, administrative fines, and other sanctions as предусмотрed under the NDPA 2023.
The Commission stated that the compliance directive is aimed at strengthening accountability, improving data governance, and reducing the risk of data breaches within Nigeria’s higher education sector.
It urged the management of tertiary institutions to treat data protection as a core governance responsibility by investing in proper security measures, staff training, and professional oversight.
FREE GUIDE AND CONSULTATION
-
UPDATES | ADVISORY | COMPLIANCE | NEWS
Nigeria Data Protection (Amendment) Bill, 2026: All you need to know.
A major debate is currently trending in the data protection space regarding the controversial Nigeria Data Protection Amendment Bill. The proposed bill, sponsored by Senator Ned Nwoko, seeks to introduce strict adjustments to how international tech companies handle Nigerian user data. The most heavily searched aspect of this bill is a mandate requiring every social […]
-
EVENTS | INTERNATIONAL | NEWS | UPDATES
ISACA Honours NDPC for Distinguished Regulatory Leadership in Nigeria
The Nigeria Data Protection Commission has received the Industry Leader Regulator Recognition Award from the ISACA Lagos Chapter during its 30th-anniversary celebration in Lagos. The ISACA Lagos Chapter honored the commission for its distinguished leadership, resilience, and commitment to building a trusted digital ecosystem in Nigeria. Ms. Omoikhefe Ahimie, the commission’s Lagos Liaison Officer, received […]
-
ADVISORY | COMPLIANCE | NEWS
Why non-compliant Businesses Are Being Locked Out of Government and Corporate Contracts
In business data protection compliance certificate is no longer just a regulatory formality—it is a mandatory license to do business. Across the globe, governments and major corporations are actively severing ties with third-party vendors, suppliers, and contractors who cannot prove their data protection compliance. If your organization lacks a valid data protection registration certificate, you […]
-
Fake Compliance Scams Target Small Businesses: How to Verify Your Data Protection Status for Free
As regulatory bodies crack down on data privacy violations, a rising wave of predatory compliance scams is targeting small businesses, charities, and independent professionals across the country. Fraudulent actors, posing as official agents, are demanding exorbitant fees for “mandatory” data protection registration certificates—fees that many struggling organizations simply cannot afford in today’s harsh economic climate. […]
-
The Beginner’s Guide to Renewing Your NDPC Data Protection Registration under the NDPA 2023
If your business collects, stores, or processes the personal data of up to 200 or more Nigerians within a six-month period—whether it’s customer phone numbers, BVNs, email addresses, or employee payroll—you are legally classified as a data controller or data processor. Under the Nigeria Data Protection Act (NDPA) 2023, managing this data comes with strict […]
-
ADVISORY | COMPLIANCE | DATA BREACH | INTERNATIONAL | NEWS | UPDATES
Multiple Nigerian Communications Commission Web Servers Compromised by Threat Actors
The Nigerian Communications Commission (NCC) is facing a significant security incident following a cyberattack that successfully compromised at least two of its public-facing web servers. Threat actors breached the infrastructure hosting consumer.ncc.gov.ng (the NCC Consumer Affairs bureau portal) and csirt.ncc.gov.ng (the official portal for the NCC’s Computer Security Incident Response Team). The irony of the […]
