The Nigeria Data Protection Commission (NDPC) has commenced an investigation into the data processing activities of global e-commerce platform Temu over alleged violations of the Nigeria Data Protection Act (NDP Act).

The directive was issued by the NDPC National Commissioner and Chief Executive Officer, Vincent Olatunji, who ordered an immediate inquiry into the company’s operations in Nigeria.

According to the Commission, the investigation was triggered by concerns relating to online surveillance through personal data processing, accountability obligations, compliance with data minimisation principles, transparency requirements, duty of care, and cross-border data transfers.

Preliminary findings indicate that Temu processes the personal data of approximately 12.7 million Nigerian users, while maintaining an estimated 70 million daily active users globally.

The NDPC warned that data processors acting on behalf of data controllers without verifying compliance with the NDP Act could be held liable under the law. The Commission reiterated its commitment to ensuring that all organisations operating within Nigeria adhere strictly to the provisions of the country’s data protection framework.

The Head of Legal, Enforcement and Regulations at the NDPC, Babatunde Bamigboye, Esq., CDPRP, confirmed the development, emphasising that the investigation is part of the Commission’s mandate to safeguard the data rights of Nigerians.

ISSUE-BASED ANALYSIS

Key Issues in the NDPC Investigation of Temu

  1. Online Surveillance and Personal Data Processing
    The NDPC’s probe centres on allegations that Temu may be engaging in extensive personal data processing practices that raise concerns about user surveillance and privacy infringement.
  2. Accountability and Transparency
    Under the Nigeria Data Protection Act, organisations must clearly disclose how personal data is collected, processed, stored, and shared. Any failure to provide transparent information to users could constitute a regulatory breach.
  3. Data Minimisation Requirement
    The Act requires that only data strictly necessary for specified purposes be collected. Excessive or unrelated data collection may violate this principle.
  4. Duty of Care
    Organisations handling personal data are expected to implement appropriate technical and organisational safeguards to protect user information from misuse, breaches, or unauthorised access.
  5. Cross-Border Data Transfers
    Given Temu’s global operations, the NDPC is likely examining whether personal data of Nigerian users is being transferred outside the country in compliance with legal safeguards stipulated under the Act.
  6. Liability of Data Processors
    The Commission has cautioned third-party processors working on behalf of data controllers to ensure compliance. Failure to verify adherence to regulatory standards could expose them to sanctions.

Implications

If violations are established, Temu may face regulatory sanctions, compliance directives, financial penalties, or other corrective measures under the Nigeria Data Protection Act. The investigation also signals heightened regulatory scrutiny of multinational digital platforms operating within Nigeria.

The outcome of the probe is expected to shape the enforcement landscape for data protection compliance in Nigeria’s rapidly expanding digital economy.