The Nigeria Data Protection Commission (NDPC) has initiated an investigation into popular digital platforms TikTok and Truecaller over alleged violations of data privacy regulations. This move is part of the commission’s broader effort to enforce the Nigeria Data Protection Act (NDPA) and ensure global tech companies comply with national data protection laws.
Speaking at a press conference in Abuja, the NDPC’s National Commissioner and CEO, Dr. Vincent Olatunji, confirmed the ongoing probe into the two multinational companies. He emphasized that data privacy is a critical issue, and the commission is determined to hold organizations accountable for protecting users’ personal information.
“As we speak, we have even gone to the extent of investigating multinationals. We are currently investigating TikTok and Truecaller in the area of data privacy,” Olatunji stated.
According to the NDPC boss, compliance with data privacy laws in Nigeria has significantly improved. Initially, only about 4% of organizations adhered to the country’s data protection regulations. However, due to the NDPC’s intensified enforcement and engagement with stakeholders, compliance levels have now risen to over 55%.
Unlike some regulatory bodies that impose immediate penalties, the NDPC adopts a remediation-first approach. This means that rather than announcing non-compliance outright, the commission provides affected companies with corrective measures to address data privacy violations. Organizations are then monitored for six months to a year to ensure they meet compliance requirements.
Key considerations for the NDPC’s enforcement actions are:
- The severity of the data breach.
- The number of individuals affected.
- The potential economic impact of the violation.
While the NDPC prioritizes remediation, Dr. Olatunji made it clear that stronger enforcement actions, including fines and sanctions, could be applied if necessary.
At the press conference, the NDPC also unveiled the Nigeria Data Protection Act – General Application and Implementation Directive (NDP Act-GAID). This directive outlines clear guidelines for data controllers and processors, ensuring full compliance with the law.
Key aspects of the directive are:
- Principles of data protection.
- Lawful bases for data processing.
- Rights of data subjects.
- Cross-border data transfers.
- Compliance audit requirements.
- Standardized grievance redress mechanisms.
Additionally, the NDPC introduced the Standard Notice to Address Grievance (SNAG). This tool allows individuals to demand corrective action directly from companies handling their data, bypassing the need to approach the commission first. The initiative is expected to empower over 230 million Nigerians by giving them a more active role in enforcing data protection laws.
The directive is set to take effect in September 2025, with a six-month transition period for organizations to fully comply.
