The companies under investigation cut across some of Nigeria’s most sensitive industries. They include 795 financial institutions, 392 insurance brokers, 35 insurance companies, 10 pension firms, and 136 gaming operators. Each has been given 21 days to prove compliance or risk sanctions.

According to a statement signed by Babatunde Bamigboye, head of Legal, Enforcement and Regulations at the NDPC, the affected organisations must present evidence of their 2024 compliance audit returns, the appointment of a Data Protection Officer with full contact details, as well as technical and organisational safeguards they have put in place. 

They are also expected to confirm registration as a “data controller or processor of major importance.”

“These organisations are required to within 21 days of issuance provide evidence of filing NDP Act Compliance Audit Returns for 2024, evidence of designation or appointment of a Data Protection Officer, including name and contact details. 

“They are also to provide summary of technical and organisational measures for data protection within the organisation and evidence of registration as a data controller or processor of major importance,” the Commission stated.

The Commission argues that such enforcement is necessary to secure citizens’ rights under the 1999 Constitution and to strengthen trust in Nigeria’s digital economy. The NDPC says that failure to comply could trigger fines, enforcement orders, or even criminal prosecution as stipulated under the NDPA.

This latest development comes weeks after Multichoice Nigeria was fined ₦766.2 million for data protection violations, the biggest penalty imposed so far. 

The pay-TV operator was found guilty of intrusive data practices, unauthorised cross-border transfers, and processing subscriber and non-subscriber data without proper consent.

National Commissioner, Dr Vincent Olatunji, explained that the Commission operates a remediation-first approach to enforcement. He noted that businesses willing to correct violations are given an opportunity to do so before penalties are applied.

“Usually, when we investigate and find a breach, if they are ready to comply with the law, what is the point of making noise? It’s only when an organisation is unwilling to comply with the law that we are forced to impose sanctions,” he said.

Experts believe the Commission’s growing assertiveness shows a turning point. For years, compliance was largely voluntary, but this change shows that regulators are no longer content with awareness campaigns. 

The NDPA, modelled after global standards such as the GDPR, is designed both to protect Nigerians’ personal data and also to give local firms credibility in regional and international markets.

According to Dr. Babatunde Alayande, Head, PENCOM, South-West Office who spoke at a forum in Lagos, the company currently has 29 pension branches, and 180 banks, and attained the 4 million AUM in 2021.

Assets Under Management (AUM) is the total market value of the investments that a person or entity handles on behalf of investors

According to Alayande, the reviewed 2014 Pension Reform Act ushered in the contributory pension scheme that is fully funded and privately managed based on individual accounts for both the public and private sectors employees to ensure smartness under the new pension reform.

At the forum themed ‘Pension Smart: Equipping your Employees for a better future, he stated that the objective of the pension reformed act is to establish uniform rules, regulations, and standards for the habilitation, payments of retirement benefits for the public service of the federation, the FCT state, local government, and the private sector.

He said the act also made provision for the good operation of the scheme; to ensure that every person who worked received retirement benefits as when due; to assist individuals by ensuring they save to cater for their livelihood at old age and for the proper administration of the system.

“To be smarter, there are provisions in the 2014 Act that made it possible for pension laws in Nigeria to be reviewed periodically to accommodate various dynamics in the operating environment.

“The pension industry currently operates on the pension reform Act of 2014 to avert the confusion on whose authority it is to supervise and regulate pension matters in Nigeria.

The act established the pension commission as the sole regulator and supervisor of all pension matters in Nigeria.

He said the theme of the forum was very apt for pension to be smart to equip employees for the future, employers are expected to adhere to the pension act 2014 to ensure the remittance of pension contributions of employees into their employment account within 7days of salary payment.