NDPC serves an investigation notice over a cybersecurity-linked compliance failure

On 1 April 2026, the NDPC served a Notice of Investigation over a data protection compliance failure linked to a cybersecurity incident, with the Federal Government simultaneously moving to strengthen national cybersecurity. The underlying incident was not fully disclosed at the time, though the cited reporting named Remita Payment Services and Sterling Bank among the entities under review. A separate investigation into the Corporate Affairs Commission breach followed on 17 April.

The notice confirms that the NDPC is conducting breach investigations on statutory timelines under the NDPA 2023, in coordination with federal cybersecurity policy rather than independently of it. Breach response protocols and NDPC notification clocks now constitute live obligations for organisations holding Nigerian personal data.