Archive · Nigeria
All 13 archive entries on Nigeria, most recent first.
The NDPC executed two memoranda of understanding on 8 May 2026, one with the Bureau of Public Procurement and one with the Nigeria Governors' Forum. The Bureau of Public Procurement agreement threads data protection compliance into federal procurement, making every vendor and contractor in the government supply chain auditable on NDPA grounds as part of contract compliance.
The NDPC hosted a two-day peer exchange in Abuja on 4 and 5 May 2026, bringing data protection regulators from nine African countries and multilateral institutions together to discuss cross-border enforcement coordination. Continental coordination among regulators has been discussed for years, but this meeting was distinguished by the enforcement position of the host: Nigeria convened the exchange while the Temu investigation, the CAC probe and the April advisory were all active, which made the session a working exchange of live case strategies rather than a general discussion. For organisations operating across multiple African jurisdictions, this points toward synchronised regulatory scrutiny, where an enforcement approach tested by one authority is more likely to be applied by its neighbours.
The NDPC confirmed on 17 April 2026 that it is investigating a reported breach of the Corporate Affairs Commission's database under section 46(3) of the NDPA 2023, alongside a coordinated Federal Government cybersecurity response. The CAC holds identity and corporate data on effectively every registered business and director in Nigeria.
On 16 April 2026, the NDPC issued a data protection advisory directing all controllers and processors, including government ministries, to strengthen technical and organisational measures against escalating cyber threats: certified data protection officers, regular data protection impact assessments, multi-factor authentication, and NDPA 2023-grade security controls. The advisory followed the 1 April investigation notice and the Corporate Affairs Commission breach probe, and preceded further enforcement action.
SEC Nigeria issued a rules exposure draft on 14 April 2026 setting a minimum paid-up share capital of N7.5 billion for Free Trade Zone Entities seeking to offer or issue shares on the Nigerian capital market, with a two-week comment window through the Rules Committee. Nigeria's free trade zones host technology, digital payments and blockchain infrastructure operators, and a N7.5 billion capital floor for public market access determines which of them can raise capital domestically and which must structure offshore.
The Central Bank of Nigeria granted Flutterwave a national microfinance banking licence in early April 2026, clearing one of Africa's largest payments processors to take deposits, lend and run accounts, with its SendApp remittance product, which has over one million users, as the consumer foundation. The licence is one data point in a deliberate CBN consolidation: Paystack acquired Ladder Microfinance Bank in January 2026, and OPay and Moniepoint were upgraded to national banking licences before that.
The Central Bank of Nigeria inaugurated a Payments Service Providers Committee in Lagos on 2 April 2026, seating the CBN, commercial banks, mobile money operators and fintechs at one table, with a new Payments System Vision promised within a month. The scale being governed is considerable: Nigeria's digital payments system processed 11.2 billion transactions worth over one quadrillion naira in 2024.
On 1 April 2026, the NDPC served a Notice of Investigation over a data protection compliance failure linked to a cybersecurity incident, with the Federal Government simultaneously moving to strengthen national cybersecurity.
On 17 February 2026, the NDPC ordered an immediate investigation into Temu (Whaleco Technology / PDD Holdings) over how the platform collects, processes and transfers Nigerian users' personal data, with cross-border transfers as the stated focus. The probe is the first major investigation of a global e-commerce platform under the NDPA 2023 and GAID framework, and it grew out of the sector-wide investigation of 1,368 organisations that the NDPC launched in August 2025.
SEC Nigeria revoked the registration of Kensington Agro Trading Limited as a capital market operator, with immediate effect, in a circular signed 9 February 2026 and published 2 March, acting under section 61(6) of the Investments and Securities Act 2025 and Rule 34(1) of the SEC Rules.
On 30 January 2026, SEC Nigeria issued a public warning against Aurum Bot, an online platform soliciting cryptocurrency investments from Nigerian retail investors without registration or a licence.
SEC Nigeria's second public warning of 30 January 2026 named ModMount Services Limited, a CFD broker offering forex, stocks, indices, commodities and cryptocurrency to Nigerian investors, as unlicensed and suspected of fraudulent activity. Unlike a plain scam, ModMount presents as a legitimate international broker giving Nigerians access to global markets, with offshore licensing claims standing in for local authorisation.
The NDPC's General Application and Implementation Directive 2025 (GAID), issued 20 March 2025 and effective from 19 September 2025, is the instrument that converts the Nigeria Data Protection Act 2023 into day-to-day compliance obligations: registration, lawful bases, data subject rights, cross-border transfer rules and enforcement mechanics. The GAID sets a materially higher bar than the NITDA-era framework it replaced.
Enforcement decisions, new laws and regulatory movement across African jurisdictions, in one brief. Free, and built to be forwarded to the colleague who needs it.
Your address goes to our email service provider and is used to send you the Digest, nothing else. Unsubscribe in one click, in every issue. Privacy policy. This site itself sets no cookies.