NDPC orders data controllers to harden security: certified DPOs, MFA, impact assessments

On 16 April 2026, the NDPC issued a data protection advisory directing all controllers and processors, including government ministries, to strengthen technical and organisational measures against escalating cyber threats: certified data protection officers, regular data protection impact assessments, multi-factor authentication, and NDPA 2023-grade security controls.

The advisory followed the 1 April investigation notice and the Corporate Affairs Commission breach probe, and preceded further enforcement action. The sequence indicates a pattern: the NDPC advises broadly, investigates confirmed breaches, then enforces against non-compliant entities. The advisory converts general security expectations into specific, citable requirements, which typically precedes enforcement against their absence.

Organisations that cannot evidence a certified DPO, MFA deployment and current DPIAs carry documented exposure under this framework.