NDPC investigates the Corporate Affairs Commission over a database breach

The NDPC confirmed on 17 April 2026 that it is investigating a reported breach of the Corporate Affairs Commission's database under section 46(3) of the NDPA 2023, alongside a coordinated Federal Government cybersecurity response.

The CAC holds identity and corporate data on effectively every registered business and director in Nigeria. The NDPC's decision to publicly investigate a sister government agency indicates that public-sector data controllers are not exempt from enforcement.

The investigation also confirms that the NDPC's breach machinery operates on statutory timelines. Investigation windows of 60 to 90 days should be factored into breach response planning, including insurance provisions.