Nigeria's NDPC Compliance Notice — Auditing Data Protection Across 649 Education Institutions

Nigeria's Data Protection Act 2023 (NDPA), enforced by the Nigeria Data Protection Commission (NDPC) since June 2023, classified the education sector as processing data of 'major importance' in a Guidance Notice dated 14 February 2024, given the scale and sensitivity of student data that schools and EdTech platforms handle.

On 19 February 2026, the NDPC escalated this into concrete enforcement: a compliance notice to 649 higher-education institutions — federal, state and private universities, polytechnics and colleges of education — giving them 21 days (deadline 11 March 2026) to submit evidence of 2024 NDP Act compliance audit returns, a designated Data Protection Officer, a summary of technical and organisational safeguards, and registration as a Data Controller or Processor of Major Importance.

The NDPC stated that institutions failing to comply, or unable to demonstrate adequate data protection practice, face enforcement orders, administrative fines and potential criminal prosecution under the NDPA, part of the Commission's declared sector-by-sector investigation strategy. As of this writing the notice's 21-day window had only just closed, so no compliance or penalty outcomes have yet been published.