The Nigeria Data Protection Commission (NDPC) has launched a full-scale forensic investigation into the University of Lagos (Unilag), Lotus Bank, and Hackerbella Ltd following public complaints alleging that students’ personal data was used to open bank accounts without their consent or a lawful basis.
The National Commissioner and Chief Executive Officer of the NDPC, Dr. Vincent Olatunji, directed the commission’s enforcement team to undertake a comprehensive assessment of the circumstances surrounding the collection, sharing, and overall processing of the affected students’ personal information.
The probe will scrutinize the specific roles and regulatory responsibilities played by the university, the non-interest bank, and the tech firm in the alleged breach.
According to an official statement signed by the Head of Legal, Enforcement & Regulations at the NDPC, Babatunde Bamigboye, the investigation will evaluate the general compliance posture of all three entities under the provisions of the Nigeria Data Protection Act, 2023 (NDP Act).
The commission’s probe will systematically assess the operational safeguards and procedures used across the three organizations. Specifically, it will evaluate the lawfulness, fairness, and transparency of processing activities, privacy notices, data-sharing arrangements, data minimization, and purpose limitation policies. The team will also review Data Protection Impact Assessments (DPIAs), alongside any credit scoring, profiling, or automated decision-making systems used during the onboarding process. Finally, the investigation will assess data retention policies and the technical and organizational security measures implemented to protect the fundamental rights and freedoms of the data subjects.
Emphasizing the sensitive nature of academic records, the NDPC reiterated that higher institutions hold a heightened fiduciary duty to safeguard the personal information of students, faculty, and administrative staff.
The data protection regulator issued a firm warning to tertiary and secondary institutions across Nigeria that are yet to align their operations with national data governance frameworks, urging immediate compliance with all existing NDPC directives to avoid severe statutory penalties under the NDP Act.