NDPC probes CAC data breach, signals tighter enforcement

Nigeria’s data protection regulator has commenced an investigation into the reported breach of the Corporate Affairs Commission (CAC) database, in a development that points to a more assertive enforcement approach under the Nigeria Data Protection Act (NDP Act), 2023.

The Nigeria Data Protection Commission (NDPC), which invoked Section 46(3) of the Act, said the move underscores a growing regulatory emphasis on protecting personal data and sustaining trust in the country’s digital economy.

In a statement issued on Friday in Abuja by Babatunde Bamigboye, head of legal, enforcement and regulations, the commission flagged rising concerns over the sophistication of cyber threats targeting critical national databases. It noted that threat actors are increasingly deploying advanced tactics, including large-scale data exfiltration and cross-platform compromises across interconnected systems.

Vincent Olatunji, national commissioner and chief executive officer of the NDPC, has directed the commission’s technical team to collaborate with relevant authorities and key institutions to strengthen existing data protection frameworks and security architecture.

As part of the probe, the NDPC said it will assess CAC’s access control systems, data protection impact assessments, as well as its vulnerability assessment and penetration testing (VAPT) protocols. Compliance procedures relating to third-party data processors will also be reviewed.

Despite the reported breach, the commission maintained that Nigeria’s data protection infrastructure remains resilient, pointing to sustained growth in the adoption of data-driven services as evidence of underlying strength.

The regulator added that ongoing interventions are aimed at preserving public confidence and supporting investment inflows into Nigeria’s expanding digital economy.