The NDPC has established procedures for receiving and investigating complaints.
Typically, the process includes the following steps:
Step 1: Submission of Complaint
- The data subject must file a written complaint to the NDPC or through its online complaint portal.
- The complaint should include:
- Full name and contact details of the complainant,
- Details of the data controller or processor involved,
- Description of the violation,
- Supporting evidence (emails, documents, screenshots, etc.),
- Date of occurrence.
Step 2: Acknowledgement & Preliminary Review
- The NDPC acknowledges receipt and performs an initial review to confirm whether the matter falls within its jurisdiction.
- If admissible, it proceeds to investigate; if not, it may advise the complainant on the appropriate channel.
Step 3: Investigation
- The NDPC may request additional information from the complainant or the data controller/processor.
- It may summon parties, conduct audits, or inspect records related to the complaint.
Step 4: Decision & Enforcement
After investigation, the NDPC can:
- Order compliance or corrective measures,
- Impose administrative fines or sanctions,
- Issue warnings,
- Order data erasure or rectification, or
- Refer the matter to law enforcement where criminal breaches are involved.
5. Right to Judicial Review
If the complainant is not satisfied with the NDPC’s decision, they have the right to seek judicial review or appeal before a competent court of law in Nigeria.
This ensures checks and balances on the Commission’s decisions and upholds the principle of fair hearing.
6. Relationship with Data Controllers and Processors
Before escalating to the NDPC, the data subject is encouraged to first contact the Data Controller or Data Protection Officer (DPO) of the organization involved.
If no satisfactory response is received within a reasonable period (usually 30 days), the data subject may then escalate the complaint to the NDPC.
