Nigeria’s Data Regulator Sounds the Alarm as Cyber Threats Target Financial and Digital Infrastructure

The NDPC is done playing nice — and it wants every organisation handling Nigerian data to know it.

The Nigeria Data Protection Commission (NDPC) has fired off a strongly-worded regulatory advisory, putting Data Controllers and Data Processors across the country on notice amid what it describes as a surge in coordinated attacks on Nigeria’s financial systems and critical digital infrastructure. The culprits? What the Commission calls “shadowy threat actors” — and by the tone of this advisory, the NDPC isn’t taking any of it lightly.

Presidential Mandate, Now With Urgency

The advisory leans on President Bola Tinubu’s now-familiar data doctrine — “Data is the new oil” — but this time, it’s less inspirational quote and more regulatory ultimatum. All Ministries, Departments, and Agencies (MDAs) are reminded that the President’s directive to rigorously capture and safeguard data isn’t optional. It’s backed by the Nigeria Data Protection Act 2023, and the Commission is watching.

What Organisations Must Do — Right Now

The NDPC isn’t vague about what it expects. The advisory lays out a clear technical and organisational checklist that every data controller and processor — public or private — is expected to act on immediately. Here’s what’s on the table:

• Get a qualified Data Protection Officer — trained, certified, and actually empowered to do the job.
• Build real Privacy Policies — not the boilerplate kind. Implement them.
• Run Data Privacy Impact Assessments before things go wrong, not after.
• Lock down access — Multi-Factor Authentication (MFA) is no longer a bonus feature; it’s baseline.
• Go zero-trust — network segmentation and zero-trust architecture are now expected standards.
• Patch. Everything. Now. — Unpatched vulnerabilities are open invitations, and the Commission knows it.
• Secure your cloud, APIs, and databases — credentials left exposed are liabilities waiting to happen.
• Monitor in real-time — logging and threat detection must be active, not reactive.
• Encrypt and manage keys properly — secure credential handling is non-negotiable.
• Run VAPT on critical systems — Vulnerability Assessment and Penetration Testing should already be on your calendar.
• Test your backups — resilience isn’t theoretical. Prove it works.

The Compliance Window Is Closing

The NDPC says it’s willing to offer regulatory support to organisations looking to get their houses in order — but that offer comes with a clear flip side. Organisations that ignore the advisory or drag their feet on implementation risk real legal consequences under the NDPC Act 2023.

This isn’t the Commission’s first reminder, and it likely won’t be the last. But given the scale of the threats it says it has detected, this one carries a different weight.

For Nigerian businesses, fintechs, health platforms, and government agencies sitting on mountains of personal data, the message is simple: the era of treating data protection as a compliance checkbox is over. The infrastructure is under attack — and regulators are paying attention.

Advisory signed by Babatunde Bamigboye, Esq., Head of Legal, Enforcement & Regulations, NDPC.