NDPC Commences Sector-By-Sector Investigation on Companies

Affected sectors, as indicated in the notice, include insurance, pension, gaming and banking (financial institutions). The affected organisations include 795 financial institutions, 35 insurance companies, 392 insurance brokers, 136 gaming companies and 10 pension companies. These organisations are required to present the following to the NDPC as evidence of compliance on or before the expiration of the twenty-one (21) day deadline:

1. evidence of filing NDPA Compliance Audit Returns for 2024;
2. evidence of designation or appointment of a Data Protection Officer (DPO), including name and contact details of the DPO;
3. a summary of technical and organisational measures for data protection deployed within the organisation; and
4. evidence of registration as a Data Controller or Processor of major Importance.

The NDPC has further warned that a failure to comply with the compliance notice may result in enforcement action, including issuance of enforcement orders, administrative fines, and/or criminal prosecution in accordance with the NDPA.

Next Steps
Organisations above or associated companies (including data controllers of the above companies) would need to ensure compliance with the above request. Where this information/documents are not available, it would be relevant to get these sorted within (twenty-one) 21 days. Whilst specific organisations and sectors have been identified above, other organisations and sectors may need to look inward to put their respective data governance practices in order.

Should you have any questions regarding the information in this legal alert, please do not hesitate to contact Sumbo Akintola or Timothy Ogele.