The Nigeria Data Protection Commission (NDPC) has issued a 21-day ultimatum to tertiary institutions across the country to comply with Nigeria’s data protection requirements, as part of its ongoing enforcement of the Nigeria Data Protection Act (NDPA) 2023.
The directive affects universities, polytechnics, colleges of education, and other higher institutions that process large volumes of personal data belonging to students, academic staff, non-teaching staff, and other stakeholders.
Mandatory Compliance Notice
According to the Commission, the 21-day deadline follows the identification of compliance gaps within the tertiary education sector, particularly in areas relating to data governance, security safeguards, and regulatory reporting obligations.
The NDPC directed affected institutions to submit evidence of compliance within the stipulated timeframe, including:
- Proof of filing their 2024 Data Protection Compliance Audit Returns
- Evidence of designation or appointment of a Data Protection Officer (DPO), with valid contact details
- A summary of technical and organisational measures implemented to secure personal data
- Evidence of registration as a Data Controller or Data Processor of Major Importance, as required by law
The Commission stressed that these obligations apply to institutions that process large-scale personal data, especially data relating to minors and young adults.
Warning on Enforcement Actions
The NDPC warned that failure to comply with the directive within the 21-day period may result in enforcement orders, administrative fines, and other sanctions provided under the NDPA 2023. It emphasised that data protection compliance is mandatory and not optional for public and private tertiary institutions.
Tertiary institutions routinely process sensitive personal data such as academic records, biometric identifiers, medical information, financial data, and disciplinary records. The NDPC noted that weak data protection practices expose data subjects to risks including identity theft, fraud, unauthorised access, and data misuse.
The Commission urged governing councils, vice-chancellors, rectors, and provosts to prioritise data protection compliance by strengthening internal controls, training staff, and engaging qualified data protection professionals.
- Nigeria Data Protection (Amendment) Bill, 2026: All you need to know.
- ISACA Honours NDPC for Distinguished Regulatory Leadership in Nigeria
- Why non-compliant Businesses Are Being Locked Out of Government and Corporate Contracts
- Fake Compliance Scams Target Small Businesses: How to Verify Your Data Protection Status for Free
- The Beginner’s Guide to Renewing Your NDPC Data Protection Registration under the NDPA 2023
What is the NDPC 21-day deadline for Nigerian tertiary institutions?
The 21-day deadline is a compliance directive issued by the Nigeria Data Protection Commission (NDPC) requiring Nigerian universities, polytechnics, and colleges of education to comply with the Nigeria Data Protection Act 2023 (NDPA). Institutions must submit evidence of compliance or face regulatory enforcement.
Which Nigerian institutions must comply with the NDPC directive?
All tertiary institutions in Nigeria including federal, state, and private universities, polytechnics, colleges of education, monotechnics, and professional institutions must comply. Any institution handling student data, staff records, admissions data, or alumni information is covered under Nigerian data protection law.
What NDPC compliance requirements apply to Nigerian universities and polytechnics?
Affected institutions must submit:
1. Nigeria Data Protection Compliance Audit Return (DPAR)
2. Evidence of Data Protection Officer (DPO) appointment in Nigeria
3. Summary of data security and cybersecurity measures
4. NDPC registration as a Data Controller or Processor of Major Importance
These requirements apply regardless of institution size or ownership.
What are the penalties for non-compliance with Nigeria’s data protection law?
Nigerian institutions can fast-track compliance by engaging a licensed Nigerian Data Protection Compliance Organisation (DPCO), appointing a qualified DPO, completing a DPAR, training staff on data protection obligations, and implementing NDPC-approved technical and organisational safeguards.
