- The Nigeria Data Protection Commission launched a forensic investigation into UNILAG, Lotus Bank and Hackerbella Ltd over alleged data violations
- Public complaints triggered the probe, alleging that students’ personal data were used to open bank accounts without the students’ knowledge or consent
- NDPC’s national commissioner directed investigators to assess how the three parties collected, used and shared the affected students’ personal data
Legit.ng journalist Victor Enengedi has over a decade’s experience covering energy, MSMEs, technology, banking and the economy.
The Nigeria Data Protection Commission (NDPC) has launched a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and technology firm Hackerbella Ltd, following allegations that students’ personal data were used to open bank accounts without their consent.
Babatunde Bamigboye, head of legal, enforcement and regulations at the NDPC, announced the development in a statement issued on Wednesday, August 12, 2026, in Abuja.
Source: UGC
Bamigboye said the probe was triggered by public complaints alleging unlawful use of students’ data, and that NDPC National Commissioner Vincent Olatunji had personally directed the investigation team to carry out a full assessment of how the affected students’ data was collected, used and shared.
What NDPC investigation will cover
The inquiry will establish the specific roles played by each of the three organisations in the alleged data processing, and will measure their conduct against obligations set out in the Nigeria Data Protection Act, 2023.
Bamigboye said:
“The investigation will, among others, cover Data Protection Impact Assessments (DPIAs), the lawfulness and transparency of any credit scoring or profiling activities, and the use of automated decision-making systems.
“It will also examine the adequacy of privacy notices, data-sharing arrangements, lawful bases for processing, data minimisation, purpose limitation, retention policy, and appropriate technical and organisational safeguards for data subjects’ rights.”
Investigators will also look at the potential risks that the alleged breach poses to the rights and freedoms of the students whose data is believed to have been compromised.
NDPC warns other institutions
Beyond UNILAG, the NDPC used the announcement to put other educational institutions on notice. Bamigboye warned that any institution yet to comply with the commission’s existing data protection directives must do so without further delay.
Source: UGC
He said organisations that hold the personal data of students, staff and community members carry a legal and ethical duty to handle that information lawfully, fairly, transparently and securely.
Bamigboye added that compliance with data protection regulations was not optional, describing it as essential to defending the rights of data subjects and building responsible data governance across the education sector.
Recall that the NDPC earlier launched an immediate probe into the e-commerce platform Temu over alleged violations of the country’s data privacy law.
NDPC launches Know Your Data Rights campaign
In related news, the NDPC launched a Know-Your-Data-Rights campaign to educate the public on what their rights and responsibilities are in relation to data protection..
The campaign warned Nigerians to be careful when surfing the internet or shopping online, and avoid opening strange mails or clicking strange links.
NDPC noted that such actions from users could compromise data safety and lead to huge losses.
Source: Legit.ng