After a sector-wide investigation, some 1,369 indigenous firms have been identified by the Nigeria Data Protection Commission (NDPC) to have flouted provisions of the Nigeria Data Protection Act (NDPA) 2023.

The NDPC probe targeted companies in sensitive industries such as banking, insurance, pensions, gaming, and insurance brokerage.

In a statement on Monday, signed by Head of Legal, Enforcement and Regulations at the NDPC, Babatunde Bamigboye, the Commission has handed the companies, which include 795 financial institutions, 21 days to submit evidence of compliance with the NDPA or face sanctions.

The list of the companies published by the Commission also include 392 insurance broker firms, 35 insurance companies, 10 pension companies, and 136 gaming companies.

Bamigboye explained that the move aligned with the NDPC’s mandate to protect the rights and freedoms of data subjects under the 1999 Constitution while strengthening Nigeria’s digital economy.

He stressed that responsible use of personal data is crucial to the country’s trusted participation in both regional and global markets.

According to him, the Commission has already issued compliance notices to the organisations, demanding they show proof of adherence to key provisions of the NDPA.

These include filing their 2024 compliance audit returns, appointing a Data Protection Officer with full contact details, outlining technical and organisational data protection measures, and confirming registration as a data controller or processor of major importance.

“These organisations are required to within 21 days of issuance provide evidence of filing NDP Act Compliance Audit Returns for 2024, evidence of designation or appointment of a Data Protection Officer, including name and contact details.

“They are also to provide summary of technical and organisational measures for data protection within the organisation and evidence of registration as a data controller or processor of major importance,” the Commission stated.