The Nigeria Data Protection Commission (NDPC) has commenced an investigation into an alleged data breach involving Remita Payment Services Ltd., Sterling Bank, and other related entities, in what is shaping up to be a significant regulatory review of data protection practices within Nigeria’s digital payments ecosystem.
Investigation Commences with Formal Notice
According to the Commission, a Notice of Investigation was issued on April 1, 2026, in line with its standard enforcement procedures. Since the notice was served, relevant parties and stakeholders have been cooperating with the NDPC by providing necessary information to aid the investigation.
The inquiry is expected to establish the facts surrounding the alleged breach and determine whether any violations of data protection regulations have occurred.
Focus on Data Protection Compliance and Risk Assessment
The NDPC stated that the investigation will assess several critical factors, including the type of personal data involved, the nature and scope of the alleged breach, the level of risk posed to affected individuals, and the adequacy of mitigation measures implemented by the organizations involved.
The Commission emphasized that the objective is to ensure that data subjects are protected through proper technical and organisational safeguards, in line with best practices and regulatory requirements.
Wider Scrutiny of Digital Payment Ecosystem
The National Commissioner/CEO of the NDPC, Vincent Olatunji, has also directed that the investigation extend beyond the immediate entities involved. According to him, organisations that operate digital payment systems without implementing adequate data protection measures, as required under the Nigeria Data Protection Act, 2023, will also come under review.
This broader approach reflects the Commission’s commitment to strengthening compliance across the entire digital ecosystem and preventing systemic vulnerabilities that could expose users to data risks.
Regulatory Enforcement and Industry Implications
The NDPC’s Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, signed the official statement announcing the investigation. The development signals heightened regulatory attention on data privacy practices, particularly among financial technology and banking institutions handling sensitive personal information.
As the investigation progresses, industry observers expect its outcome to potentially set important precedents for data governance, compliance standards, and enforcement actions within Nigeria’s rapidly expanding digital economy.