The Nigeria Data Protection Commission (NDPC) has commenced an investigation into popular e-commerce platform Temu following allegations of a data breach involving Nigerian users.
In a statement issued on Monday, the NDPC confirmed that it received complaints and intelligence reports suggesting possible unauthorized collection, processing, and exposure of personal data belonging to Nigerian citizens who use the Temu platform. The development has raised fresh concerns about data privacy, cross-border data transfers, and compliance with Nigeria’s data protection laws.
According to the Commission, the investigation will focus on whether Temu’s data processing activities align with the provisions of the Nigeria Data Protection Act (NDPA) 2023, particularly in areas such as user consent, data minimisation, purpose limitation, and safeguards for international data transfers.
“The protection of Nigerians’ personal data is a national priority,” the NDPC stated. “Any organisation, local or foreign, that processes personal data of Nigerians must comply fully with the NDPA, regardless of where such organisation is domiciled.”
Concerns Over User Data
Temu, a fast-growing online marketplace known for low-cost consumer goods, has gained significant traction in Nigeria over the past year. However, global scrutiny has followed the platform, with privacy advocates in several jurisdictions questioning its data collection practices, including access to device information, behavioural data, and third-party sharing arrangements.
The NDPC noted that its probe will assess:
- The nature and volume of personal data collected from Nigerian users
- Whether users were adequately informed and gave valid consent
- The security measures in place to prevent data breaches
- Compliance with rules governing cross-border data transfers
Possible Sanctions
Under the NDPA, organisations found guilty of data protection violations may face significant administrative fines, corrective orders, suspension of data processing activities, and reputational damage. The NDPC also has the authority to mandate remedial actions, including independent data protection audits.
Industry experts say the investigation sends a strong signal to multinational technology companies operating in Nigeria.
“This action shows that Nigeria is no longer a soft ground for data exploitation,” said a cybersecurity and data protection analyst. “Foreign digital platforms must respect local laws or risk sanctions.”
Public Assurance
The NDPC urged Nigerians to remain vigilant about how their personal data is used and encouraged affected individuals to submit complaints or evidence related to the alleged breach.
The Commission reaffirmed its commitment to enforcing data protection standards, strengthening digital trust, and ensuring that Nigeria’s rapidly growing digital economy is anchored on privacy, security, and accountability.
As investigations continue, the outcome of the NDPC’s probe into Temu is expected to set an important precedent for data protection enforcement against global digital platforms operating within Nigeria.
