An audit by ITPulse of 21 registered political parties and INEC found that not one subject met the minimum requirements of Nigeria’s data protection law. Ten parties are collecting National Identification Numbers with no policy, no consent, and no accountability. Legal experts say the violations are serious. The regulator responsible for enforcement did not respond to questions.
By Epiphanus Obia
Of the 21 registered political parties and the Independent National Electoral Commission (INEC) reviewed by this reporter, none met the basic requirements that Nigerian law sets for how personal data should be collected, handled, and explained to citizens. Zero were fully compliant, two were partially compliant, while the rest (twenty parties and INEC) failed.
INEC, the body that manages the biometric records of over 93 million Nigerians, scored only 16 out of a possible 62 points.
The audit
Between 23rd and 25th April 2026, ITPulse audited the websites of all 21 accredited political parties as listed in INEC’s portal, plus INEC itself.
Each subject was checked against 31 criteria drawn from the Nigeria Data Protection Act (NDPA) 2023 and the Nigeria Data Protection Commission’s General Application and Implementation Directive (GAID) of 2025.
The criteria covered privacy policies, cookie notices, data collection forms, technical security, and specific NDPA compliance markers, including whether a Data Protection Officer had been named and whether foreign data transfers had been disclosed.
Where forms existed, they were opened and all fields documented. Where privacy policy links existed, they were clicked. Where the link went somewhere unexpected, that was noted too.
The full methodology and subject-by-subject scores are published alongside this story, and can be accessed through the link at the foot of the story
What the law requires
The NDPA 2023 has been in force for nearly three years. The GAID, published in March 2025 and taking full effect from 19th September 2025, lays out in detail what compliance should look like. Neither of the documents is ambiguous, and neither creates exceptions for political actors or parties.
Dr. Olumide Babalola, Managing Partner at Olumide Babalola LP and a PhD holder in privacy law, put the legal position plainly. “When political parties collect personal data from members, supporters, or registrants, they are classified as data controllers under the NDPA 2023,” he said. “As such, they are subject to the full range of obligations applicable to any controller processing personal data in Nigeria.”
Those obligations include registering as a Data Controller or Processor of Major Importance, publishing a privacy policy on their website, identifying a lawful basis for every processing activity, designating a Data Protection Officer who reports directly to senior management, and filing annual Compliance Audit Returns with the NDPC by 31st March each year.
There is one obligation that goes even further. Under Section 30 of the NDPA, political opinions and affiliations are classified as sensitive personal data, sitting in the same legal category as health records and biometric information.
Joining a party is, by definition, a political affiliation declaration, and that classification matters. “The NIN, voter’s card, and political affiliation all constitute sensitive personal data,” Dr. Babalola said. “Parties must conduct a Data Privacy Impact Assessment for high-risk processing activities, including systematic monitoring, profiling, or processing of sensitive data.”
Referencing available information, not one party in this audit had conducted or published such an assessment.
What the audit found
The two best performers were the African Democratic Congress (ADC) at 62.5 per cent and the African Action Congress (AAC) at 59.3 per cent. Both had real privacy policies with substantive content: data categories, user rights, and a contact route for complaints. But, both still fell below the 75 per cent full compliance benchmark, partly because neither acknowledged political affiliation as sensitive data and neither had a cookie notice.
Meanwhile, sixteen of the remaining 20 parties scored below 30 per cent. The All Progressive Congress (APC), which controls the presidency and 31 governorships, scored 22.2 per cent. The People Democratic Party (PDP), which came second in the last presidential election, scored 23.1 per cent. While the National Rescue Movement (NRM) came last at 12.5 per cent.
When the results are broken down by category, one finding stands above the rest. On technical security (whether sites used HTTPS, had valid SSL certificates), the average across all 22 subjects was 47 per cent. Manageable, if not impressive. But on every other measure that requires telling citizens something, the numbers tell another story. Cookie notice: 0 per cent. NDPA compliance markers: 4 per cent. Privacy policy: 9 per cent.
Not one of the 22 subjects had a cookie notice. Not even the usual pop-up, nor a bar at the bottom of the page. Nothing from all subjects.
The GAID is specific: cookie notices must appear prominently on the homepage, not where they “may go unnoticed.” Every party website and the INEC website failed in the same way.
Three things were found during the audit
Several findings stuck out well beyond standard non-compliance.
Top of the list is PDP. Nigeria’s main opposition party has a privacy link in the footer of its website and a consent checkbox on its contact form. Both were clicked during this audit. Both went to the same place: a barbershop in New York City. The page that loaded was a Sitejet web-builder template for a fictional business called “Gentleman — The Original Barber Shop,” at 1601 Broadway, complete with opening hours and a haircut menu.
The PDP website was built on Sitejet, a German web platform, and whoever put the site together never replaced the default template privacy link with an actual policy. The consent checkbox on the party’s contact form, the one that says users must agree to the privacy policy before sending a message, links to a barber shop. That had not been corrected as of the publication date.
Then there is the Boot Party. Boot has built arguably the most ambitious digital political platform in Nigeria right now: a mobile app, a forum, financial tools, election monitoring features, and a dedicated page in the navigation menu for members to submit their National Identification Number. The platform is technically polished. It also has a Terms and Conditions document containing a direct contradiction that undermines whatever data commitments the party makes.
The preamble of the document states: “We shall inform you before we share your data with the Electoral Commission.”
Meanwhile, section 8 of the same document states: “We shall NOT inform you before we share your data with the Electoral Commission.”
The two clauses make opposite promises about the same action within the same document.
The Nigeria Democratic Congress (NDC) has a privacy policy link on its site. Clicking it loads the NDC homepage. The Action Alliance has separate links labelled “Privacy Policy” and “Terms of Service,” but both pages are fully blank, with no text at all.
Ten parties are actively collecting NIN
There is a form on the Social democratic party (SDP) website. It is clean and functional, with proper spacing and clear labelling. It requests First Name, Last Name, Date of Birth, Gender, Email, Phone Number, State, LGA, Ward, Polling Unit, and National Identification Number. It also asks for a passport photograph. There is no privacy notice on the page. No link to a policy. No consent checkbox. The only thing on the form besides the fields is a button that says “Complete Registration.”
Meanwhile, SDP is not alone.
Ten of the 21 audited parties — SDP, APGA, Accord, YPP, PRP, ADP, ZLP, AA, APP, and DLA — are confirmed to be collecting NIN through online registration forms. The New Nigeria Peoples Party goes further: its registration process requires members to upload photographs of both sides of their voter card, plus a facial identification verification image. BOOT has a dedicated NIN submission page sitting in its main navigation menu, labelled and advertised as a feature.
None of the parties mentioned above published a privacy policy. Not even one is linked to any policy from the form page itself. The form just collects the data and moves on.
Dr. Babalola was direct about what this means legally. “Collecting NIN without transparency, fairness, or purpose limitation violates core data processing principles,” he said. “Without a consent mechanism or any other lawful basis, the processing has no legal foundation. Consent cannot be implied from mere submission of data; it requires clear affirmative action upon provision of comprehensive information on the intended processing activities.”
Chukwuyere E. Izuogu, Data Protection Expert and Head of the Telecoms, Media and Technology Practice at Streamsowers & Köhn, put it in compliance terms. Collecting sensitive personal data without a privacy policy, transparency notice, or valid consent mechanism is likely to raise serious compliance concerns under the NDPA,” he said. The GAID also requires a Data Privacy Impact Assessment before processing sensitive personal data, a step with no evidence of completion at any party reviewed.
The financial consequences are written into the law. Under Section 48 of the NDPA, a Data Controller of Major Importance found in violation faces a penalty of up to ₦10 million or 2 per cent of annual gross revenue, whichever is greater. Any national party processing membership data at scale almost certainly qualifies for that classification.
What this does to democratic participation
Muhammed Bello Buhari, Programmes Officer at Paradigm Initiative Nigeria, framed the problem in terms his organisation deals with daily.
“At Paradigm Initiative, we constantly emphasise that you cannot separate digital rights from basic democratic rights; they are the same,” he said. “When citizens are forced to hand over their NIN, biometrics, and exact locations just to engage politically, it creates a massive chilling effect. People who understand the risks will simply choose not to participate.”
He offered a comparison that breaks down the technical language. “Imagine walking into a physical campaign rally in Lagos or Kano, and before they let you through the gate, the organisers demand your house keys, your bank details, and a scan of your face — without telling you who gets to keep them. We would never accept that offline. But that is exactly what they are doing online.”
The risks are not hypothetical. “If a poorly secured database belonging to a political party is hacked or leaked, you suddenly have a public list of names, home addresses, phone numbers, and polling units attached to a specific political ideology,” Buhari said. “In hotbed areas, this is a recipe for targeted harassment, discrimination in the workplace, or even physical violence during campaign seasons.”
On the financial side, he said, “These platforms are carelessly collecting the NIN alongside biometric photos. They are basically handing hackers a starter pack for identity theft. A bad actor could use that leaked database to open fraudulent bank accounts, take out loan-app debts in your name, or bypass security protocols — ruining ordinary Nigerians financially just because they decided to support a political movement.”
The enforcement gap
The NDPC has not been idle since it came into force; the Commission has issued compliance orders and taken action against companies in banking, telecoms, and fintech. There is no exemption in the law for political actors.
There is also no public record of the NDPC ever initiating action against a registered political party or INEC.
All three experts who responded to questions for this story identified this as a problem.
Dr. Babalola called it a significant enforcement gap, though one he believes is gradually being acknowledged and addressed. On why no political party had been investigated, he said: “The NDPC appears to have prioritised low-hanging fruit in the private sector to build compliance momentum and revenue before tackling politically sensitive entities.” He added that enforcing against parties and INEC may raise electoral law questions that make the Commission cautious. But he was unambiguous about the legal position. “The NDPA imposes no sectoral exemption for political parties or electoral institutions.”
Izuogu described the gap as real and consequential. “Visible enforcement within the political sector is important not only for ensuring compliance with the law, but also for strengthening public trust, democratic accountability, and confidence in how politically sensitive data is handled”, he said.
For Buhari, the gap sends a specific and damaging message. “It sends a very dangerous message: that the law only applies to the private sector, while the political elite and state institutions are above it,” he said. “If a fintech company loses your data, they get heavily fined by the NDPC. But if a political party harvests your data unlawfully, it is swept under the rug.”
He further said: “The NDPC must realise that enforcing data laws on political actors is not just about consumer privacy — it is about protecting the integrity of the Nigerian electoral process itself.”
This reporter sent questions to the NDPC’s Head of Media on 29th April 2026, and no response had been received at the time of publication.
What citizens can actually do
For people who have already submitted their NIN or photograph to a party with no policy, the situation is not without remedy.
Under Section 46 of the NDPA, any person who believes a data controller violated the law can file a formal complaint with the NDPC. The Commission can investigate, issue orders, and direct compensation to affected individuals.
Dr. Babalola noted that the absence of a privacy policy actually strengthens a citizen’s position rather than weakening it. “It does not extinguish these rights — indeed, it strengthens the citizen’s position, because the party has already violated transparency obligations.” Citizens can formally demand a full account of what data is held about them, request deletion where no lawful basis exists, and withdraw consent at any time. The GAID has also simplified NIN-related data corrections; no affidavit or newspaper publication is required.
Buhari had a more immediate suggestion. “Before you fill out an online form to support a candidate, ask why they need your NIN,” he said. “Your data is your property, not a campaign donation.”
What the parties and INEC said
Before publication, ITPulse sent formal right-of-reply letters to all 22 subjects, with a response deadline of 11:59 PM on 9th May 2026.
The email addresses listed on the SDP and ZLP websites were invalid, Gmail could not deliver the letters. PRP and ADC’s servers rejected the connection. The Labour Party sent an automated acknowledgement. Meanwhile, no other party replied.
Where things stand
Nigeria heads into the 2027 election cycle with digital mobilisation already running. Parties are collecting member data now and some are collecting NIN and biometric photographs with no legal framework governing what happens to that data after it is submitted.
The NDPA and GAID are in full force and their obligations are spelled out. What is missing is enforcement against the organisations that hold some of the most sensitive civic data in the country.
Buhari explains the needed actions simply: “The NDPC needs to launch proactive audits of INEC and all registered political parties immediately and publicly penalise the first party that violates them — to set a strong precedent.” He added that civil society must “expand its definition of election rigging. Stealing citizens’ data to profile and manipulate them is a form of digital rigging.”
Dr. Babalola’s summary was harder to argue with. “This constitutes multiple violations of the NDPA 2023,” he said of parties collecting NIN without consent or policy. The components involved (NIN, voter card, political affiliation, biometric photograph, precise polling unit) are sensitive personal data under Nigerian law. Collecting them without a Data Privacy Impact Assessment, without a lawful basis, and without telling citizens what is happening is not a technical oversight.
An interactive visualisation of the story can also be accessed through the attached link: ARTIFACT.
The full audit data, methodology, and scoring rubric are available HERE.