The Nigeria Data Protection Commission (NDPC) has released a list of tertiary institutions currently under investigation for alleged breaches of Nigeria’s data protection laws, marking a significant escalation in regulatory oversight of the education sector.
According to the Commission, the affected institutions include universities, polytechnics, colleges of education, and other higher learning centres identified during its ongoing sector-by-sector enforcement exercise under the Nigeria Data Protection Act (NDPA) 2023.
Why the Institutions Are Under Probe
The NDPC explained that the institutions listed are being investigated for possible non-compliance with key data protection obligations, including failures to implement adequate security measures, appoint qualified Data Protection Officers, file annual compliance audit returns, and properly register as Data Controllers or Processors of Major Importance where required.
Tertiary institutions are major custodians of sensitive personal data, such as student academic records, biometric identifiers, medical information, financial data, and disciplinary records. The Commission noted that lapses in protecting such data expose students and staff to risks including identity theft, fraud, unauthorised access, and misuse of personal information.
List Published, Full Details
As part of its transparency and accountability drive, the NDPC made public a list of institutions currently under investigation. The full and detailed list has been provided to verified subscribers.
Members of the public, institutional administrators, and stakeholders were encouraged to check the list to confirm whether their institution has been named and to take appropriate action where necessary.
What Affected Institutions Must Do
Institutions appearing on the list are expected to respond promptly to regulatory notices issued by the NDPC. This includes submitting evidence of compliance within stipulated timelines, engaging licensed data protection professionals, and addressing identified gaps in their data governance frameworks.
The NDPC also noted that institutions that believe they were listed in error may formally engage the Commission through the appropriate channels.
Possible Consequences
The Commission warned that institutions found to be in breach of the NDPA may face enforcement orders, administrative fines, mandatory audits, suspension of certain data processing activities, public naming, and in severe cases, criminal prosecution.
Download Official List Top DPCO for tertiary institutions data protection implementation
- Nigeria Data Protection (Amendment) Bill, 2026: All you need to know.
- ISACA Honours NDPC for Distinguished Regulatory Leadership in Nigeria
- Why non-compliant Businesses Are Being Locked Out of Government and Corporate Contracts
- Fake Compliance Scams Target Small Businesses: How to Verify Your Data Protection Status for Free
- The Beginner’s Guide to Renewing Your NDPC Data Protection Registration under the NDPA 2023
Data Protection and Privacy News and Advisory
