NDPC serves an investigation notice over a cybersecurity-linked compliance failure

On 1 April 2026 the NDPC served a Notice of Investigation over a data protection compliance failure linked to a cybersecurity incident, with the Federal Government simultaneously moving to strengthen national cybersecurity. The underlying incident was not fully disclosed at the time; the cited reporting named Remita Payment Services and Sterling Bank among entities under review, and a separate investigation into the Corporate Affairs Commission breach followed on 17 April (see the related entry). The procedural point stands on its own. The NDPC is running breach investigations on statutory timelines under the NDPA 2023, in coordination with federal cybersecurity policy rather than in isolation. Organisations holding Nigerian personal data should treat their breach response protocols and NDPC notification clocks as live obligations, because the Commission is demonstrably serving notices, not just issuing advisories.