NDPC Lists Strict Sanctions for Non-Compliant Tertiary Institutions in Nigeria

The Nigeria Data Protection Commission (NDPC) has outlined a range of strict sanctions that may be imposed on tertiary institutions found to be in violation of Nigeria’s data protection laws, as regulatory enforcement intensifies across the education sector.

The warning follows ongoing investigations and compliance reviews involving universities, polytechnics, colleges of education, and other higher institutions that process large volumes of personal data belonging to students, staff, and other stakeholders.

According to the Commission, data protection compliance under the Nigeria Data Protection Act (NDPA) 2023 is mandatory, and failure to meet statutory obligations will attract decisive regulatory action.

Institutions at Risk

The NDPC noted that tertiary institutions routinely process sensitive personal data, including:

Student academic and examination records
Biometric and identity data
Medical and counselling records
Financial and payment information
Disciplinary and behavioural records

Any institution that fails to lawfully collect, secure, manage, and protect such data may be sanctioned.

List of Sanctions for Tertiary Institutions for Non-Compliance

The NDPC disclosed that non-compliant tertiary institutions may face one or more of the following sanctions, depending on the severity and nature of the violation:

Enforcement Orders
The Commission may issue binding enforcement orders directing institutions to immediately correct compliance failures, suspend certain data processing activities, or implement specific remedial measures within a defined timeframe.
Administrative Fines
Institutions may be subjected to significant financial penalties as provided under the NDPA 2023. Fines may be calculated based on the gravity of the breach, the volume of data involved, and the level of negligence or intent.
Mandatory Data Protection Audits
The NDPC may require affected institutions to undergo compulsory and independent data protection audits at their own cost, with audit reports submitted to the Commission for review.
Suspension or Restriction of Data Processing
In serious cases, the Commission may order the temporary or permanent suspension of specific data processing operations, including admissions systems, learning management platforms, or biometric processing activities, until compliance is achieved.
Public Naming and Reputational Sanctions
The NDPC may publicly disclose the names of non-compliant institutions, exposing them to reputational damage and loss of public trust.
Corrective and Remedial Directives
Institutions may be ordered to retrain staff, appoint qualified Data Protection Officers (DPOs), upgrade technical security controls, or revise internal data governance policies.
Criminal Prosecution
Where violations involve willful misconduct, obstruction of regulatory processes, or serious harm to data subjects, responsible officers of the institution may face criminal prosecution in accordance with the NDPA 2023.
Continuous Regulatory Monitoring
Non-compliant institutions may be placed under enhanced regulatory supervision, requiring periodic compliance reporting and inspections by the Commission.

Compliance Is Mandatory

The NDPC stressed that ignorance of the law will not be accepted as a defence and that both public and private tertiary institutions are equally bound by the provisions of the NDPA.

The Commission urged vice-chancellors, rectors, provosts, and governing councils to treat data protection as a core governance and risk management issue, rather than a technical afterthought.

Protecting Students and the Digital Economy

According to the NDPC, strong enforcement is necessary to protect the fundamental rights and freedoms of data subjects, particularly students and young adults, and to strengthen trust in Nigeria’s rapidly expanding digital education ecosystem

SANCTIONS