A major data privacy investigation is now underway in Nigeria, and it sits at the intersection of university administration, banking, and technology. The Nigeria Data Protection Commission has launched a forensic investigation into the University of Lagos, Lotus Bank and Hackerbella Ltd over allegations that students’ personal data were collected, processed and disclosed to facilitate the opening of bank accounts without a lawful basis.
The probe is one of the most significant data protection enforcement actions involving a Nigerian university since the Nigeria Data Protection Act came into force in 2023.
The investigation follows public complaints alleging that personal information belonging to affected students was used for financial purposes without an appropriate legal basis or sufficient transparency to the data subjects.
In plain terms, students are alleging that their personal information, collected by the university for academic purposes, ended up being used to open bank accounts, apparently without their knowledge or meaningful consent. Hackerbella Ltd appears to be the technology company that facilitated or enabled this process, though the investigation will determine the exact role each organisation played.
The probe brings the handling of students’ personal information by an educational institution, a financial institution and a technology company under heightened regulatory scrutiny, with the NDPC set to examine how the data were collected, shared, processed and potentially used for profiling or automated decision-making.
The investigation is comprehensive. Vincent Olatunji, National Commissioner and Chief Executive Officer of the NDPC, has directed the Commission’s investigation team to conduct a comprehensive assessment of the circumstances surrounding the alleged collection, use and disclosure of the affected students’ personal data. The investigation will determine the respective roles and responsibilities of UNILAG, Lotus Bank and Hackerbella in the processing of the students’ information and assess whether their activities complied with obligations imposed by the Nigeria Data Protection Act, 2023.
Among the areas under investigation are the parties’ Data Protection Impact Assessments, the lawfulness and transparency of any credit scoring or profiling activities, the use of automated decision-making systems and the adequacy of privacy notices provided to affected individuals. The NDPC will further scrutinise data-sharing arrangements, the lawful bases relied upon for processing, data minimisation, purpose limitation, retention policies and the technical and organisational measures deployed to safeguard the rights of data subjects.
One of the most significant aspects of this investigation is the NDPC’s explicit focus on credit scoring and profiling. The Commission is expected to determine whether any profiling of the affected students occurred and, if so, whether it was carried out lawfully and transparently. It will also examine whether automated systems were used in making decisions concerning the students and whether the organisations involved provided sufficient information about such processing.
The focus on these areas highlights a growing regulatory concern around the use of personal data in systems that can potentially influence an individual’s access to financial services or other services with significant consequences.
This matters beyond the UNILAG case specifically. Nigerian fintechs and banks increasingly use automated systems to assess creditworthiness, open accounts, and make financial decisions. If students’ data was fed into such systems without their knowledge, the NDPC’s findings could reshape how the industry approaches university data partnerships going forward.
The NDPC did not limit its message to the three organisations named in the investigation. Beyond the specific investigation, the NDPC has issued a broader warning to educational institutions that collect and process the personal information of students, staff and other members of their communities. The Commission said institutions entrusted with such information have a heightened responsibility to ensure that personal data are processed lawfully, fairly, transparently and securely.
The NDPC consequently warned educational institutions that have yet to comply with its existing data protection compliance directives to do so immediately.
For Nigerian universities that have data-sharing arrangements with banks, fintech companies, or technology vendors, this is a direct regulatory signal. The NDPC is watching how student data moves between institutions and third parties, and the investigation into UNILAG makes clear that this kind of arrangement will now face serious scrutiny.
Before drawing conclusions, the NDPC source article is clear on one critical point. The investigation itself does not establish that UNILAG, Lotus Bank or Hackerbella breached the Nigeria Data Protection Act. The purpose of the forensic probe is to establish the facts, determine the respective responsibilities of the parties and assess compliance with applicable data protection requirements.
All three organisations are under investigation, not yet found guilty of any violation. The NDPC will publish its findings once the forensic process is complete.
As digital services become increasingly embedded in Nigeria’s education and financial sectors, the case could become an important test of how institutions obtain, share and repurpose personal information belonging to students. The eventual findings of the NDPC are therefore likely to be closely watched by universities, banks, fintechs, technology providers and students concerned about the lawful use and protection of personal data.
The outcome will be particularly significant for fintech companies and banks that partner with universities on student financial products. These arrangements have become increasingly common in Nigeria as operators look to acquire young customers early. This investigation is a reminder that the legal basis for accessing and using the data behind those partnerships is now being examined closely by a regulator with real enforcement powers.
If you are a current or former UNILAG student concerned about how your personal data may have been used, the NDPC investigation is the appropriate channel through which accountability will be established. The Commission has the authority under the Nigeria Data Protection Act 2023 to impose sanctions on organisations found to have violated data protection obligations, including fines and remediation orders.
More broadly, this case is a reminder that personal data provided to your university for academic purposes should only be used for those purposes. Any use beyond that, including sharing with banks or technology companies for financial products, requires a separate and clear legal basis that you as the data subject should be informed about.
The NDPC has been building its enforcement profile since the Nigeria Data Protection Act came into force. This investigation into three named organisations across the education, banking, and technology sectors is one of the most high-profile actions it has taken yet. How it is conducted and what findings it produces will say a great deal about how seriously Nigeria’s data protection framework will be enforced in the years ahead.
