In a bold move signaling heightened regulatory oversight, the Nigeria Data Protection Commission (NDPC) has launched an investigation into an alleged data breach involving Remita Payment Services Ltd., Sterling Bank, and several other entities.
The notice of investigation, served on April 1, 2026, marks the beginning of what industry watchers say could be a sweeping review of Nigeria’s fintech and banking sectors.
According to Babatunde Bamigboye, NDPC’s Head of Legal, Enforcement and Regulations, the affected organizations have begun submitting relevant information to assist in the probe.
“The Nigeria Data Protection Commission is committed to ensuring that the personal data of Nigerians is protected through robust technical and organisational measures,” Bamigboye said in an official statement.
At the heart of the investigation is the question of what types of personal data were allegedly compromised and how the breach might affect millions of users across the country.
NDPC will also assess the scope and nature of the breach, examining the adequacy of measures taken by the companies to mitigate potential harm.
This regulatory action is part of a broader effort by the commission to hold digital payment platforms accountable under the Nigeria Data Protection Act 2023, which mandates strict safeguards for personal information.
Vincent Olatunji, NDPC’s National Commissioner and CEO, emphasized that the inquiry is not just about one incident. “We are taking a proactive approach to review organizations operating digital payment platforms that may lack sufficient data protection mechanisms,” he said.
The NDPC’s intervention reflects growing concerns about the safety of Nigerians’ data in an era of rapid digitalization, where financial and personal information is increasingly stored online.
Industry experts believe the investigation could have far-reaching implications for fintech companies, banks, and other digital platforms, potentially reshaping data compliance standards in Nigeria.
Advertisements
Earlier this year, the NDPC also investigated Temu, highlighting concerns around online surveillance, transparency, accountability, and cross-border data transfers.
Preliminary findings revealed that Temu processes personal data of about 12.7 million Nigerians, despite having roughly 70 million daily active users globally.
The NDPC has stated that its ongoing investigations aim to prevent future breaches, promote transparency, and safeguard users’ personal information across Nigeria’s rapidly growing fintech ecosystem.
For Sterling Bank and Remita, the inquiry raises pressing questions about their current security protocols and the robustness of their data protection measures.
Regulators say this move is part of a broader campaign to ensure accountability and reinforce trust in Nigeria’s financial sector, particularly as the country embraces digital banking and online payment solutions.
As the investigation unfolds, stakeholders and customers alike are watching closely, underscoring the critical importance of data protection in the digital age.
With digital platforms handling billions in transactions daily, the NDPC’s action sends a clear message: data privacy is not optional, and companies must adhere strictly to legal and ethical standards.
