The Nigeria Data Protection Commission (NDPC) has initiated a forensic investigation into the University of Lagos (UNILAG), Lotus Bank, and technology firm Hackerbella Ltd, following allegations that students' personal data were used to open bank accounts without their knowledge or consent. The probe, announced on Wednesday, August 12, 2026, in Abuja, was triggered by public complaints, according to Babatunde Bamigboye, head of legal, enforcement, and regulations at the NDPC.
Investigation Scope and Directives
NDPC National Commissioner Vincent Olatunji personally directed the investigation team to conduct a full assessment of how the affected students' data was collected, used, and shared. The inquiry will establish the specific roles played by each of the three organisations in the alleged data processing and will measure their conduct against obligations set out in the Nigeria Data Protection Act, 2023.
Bamigboye stated: "The investigation will, among others, cover Data Protection Impact Assessments (DPIAs), the lawfulness and transparency of any credit scoring or profiling activities, and the use of automated decision-making systems. It will also examine the adequacy of privacy notices, data-sharing arrangements, lawful bases for processing, data minimisation, purpose limitation, retention policy, and appropriate technical and organisational safeguards for data subjects' rights."
Risks to Students' Rights
Investigators will also assess the potential risks that the alleged breach poses to the rights and freedoms of the students whose data is believed to have been compromised. The NDPC's action underscores its commitment to enforcing data protection regulations in the education sector, where personal data handling has come under increasing scrutiny.
The commission's announcement serves as a warning to other educational institutions. Bamigboye cautioned that any institution yet to comply with the NDPC's existing data protection directives must do so without further delay. He emphasised that organisations holding personal data of students, staff, and community members carry a legal and ethical duty to handle that information lawfully, fairly, transparently, and securely.
Compliance Not Optional
Bamigboye added that compliance with data protection regulations is not optional, describing it as essential to defending the rights of data subjects and building responsible data governance across the education sector. This development follows the NDPC's earlier probe into e-commerce platform Temu over alleged violations of Nigeria's data privacy law.
In related news, the NDPC launched a Know-Your-Data-Rights campaign to educate the public on their rights and responsibilities regarding data protection. The campaign warns Nigerians to be cautious when surfing the internet or shopping online, and to avoid opening strange emails or clicking suspicious links, as such actions could compromise data safety and lead to significant losses.
