Nigeria Data Protection Commission (NDPC) don launch sector-wide investigation of tertiary institutions across Nigeria over alleged breach of the Nigeria Data Protection Act.
The move don increase pressure on universities, polytechnics and colleges to comply fully with data protection rules.
For statement wey Head of Legal, Enforcement and Regulations for NDPC, Babatunde Bamigboye release on Thursday, the commission talk say the investigation dey in line with its mandate under the NDP Act 2023 to enforce data protection standards for all sectors.
NDPC explain say the action go help protect rights and interests of Nigerians wey their personal data dey collected, and also strengthen Nigeria digital economy through responsible data governance.
According to the commission, tertiary institutions dey process plenty personal data belonging to students, staff, alumni, research participants and other stakeholders, so dem must show full compliance with the law.
NDPC reveal say based on different sections of the Act, dem don issue Compliance Notices to some institutions. The names of affected schools publish for national newspapers on February 19, 2026.
The institutions get 21 days to submit required documents, including:
Evidence say dem file 2024 NDP Act Compliance Audit Returns
Proof say dem appoint Data Protection Officer
Summary of technical and organisational measures dem put in place to secure data
Evidence of registration as Data Controller or Processor of Major Importance
The commission warn say any institution wey fail to comply fit face enforcement action, including Enforcement Order, administrative fine or even criminal prosecution under the Act.
To further boost compliance for education sector, National Commissioner and CEO of NDPC, Vincent Olatunji, approve establishment of regulatory clinic to help institutions prevent privacy risks and quickly correct identified gaps.
The development show say regulatory oversight for Nigeria education sector don tighten, especially as many institutions now rely heavily on digital platforms for admission processing, academic records, research management and alumni engagement — all wey involve handling sensitive personal data.
