NDPC investigates the Corporate Affairs Commission over a database breach

The NDPC confirmed on 17 April 2026 that it is investigating a reported breach of the Corporate Affairs Commission's database under section 46(3) of the NDPA 2023, alongside a coordinated Federal Government cybersecurity response. A data protection regulator investigating the government's own company registry is the significant fact here. The CAC holds identity and corporate data on effectively every registered business and director in Nigeria, and the NDPC choosing to probe a sister agency publicly answers the question every public-sector data controller asks quietly: whether government entities get a pass. They do not. For everyone else, the investigation confirmed that the NDPC's breach machinery runs on statutory timelines and that investigation windows of 60 to 90 days should be built into breach response planning, insurance language included.