The Nigeria Data Protection Commission has launched investigations into TikTok and Truecaller over alleged data privacy breaches, as part of its enforcement of the Nigeria Data Protection Act.
Speaking at a press conference in Abuja on Thursday, NDPC’s National Commissioner and Chief Executive Officer, Vincent Olatunji, confirmed that the commission is scrutinizing the compliance of both platforms with Nigeria’s data protection laws.
“As we speak, we have even gone to the extent of investigating multinationals. We are currently investigating TikTok and Truecaller in the area of data privacy,” Olatunji stated.
Olatunji emphasized that if TikTok and Truecaller take corrective actions, the commission would be open to working with them rather than imposing immediate penalties.
He highlighted the significant progress in compliance levels since the NDPC began enforcement efforts.
“When we started monitoring compliance, only four percent of organizations adhered to data protection regulations. Today, due to increased enforcement and stakeholder engagement, compliance has improved to over 55 percent,” he noted.
The NDPC prioritizes remediation before applying penalties. Organizations found in breach must: Undergo corrective measures based on the severity of breaches, Keep detailed records of their data processing activities and be monitored for six months to a year to ensure compliance
However, Olatunji warned that the NDPC would not hesitate to take stronger enforcement actions where necessary.
During the event, the NDPC presented the Nigeria Data Protection Act – General Application and Implementation Directive (NDP Act-GAID), which serves as a detailed guide for data controllers and processors to follow the rules.
Olatunji referred to the directive as an important advancement in Nigeria’s efforts to protect data privacy, particularly as new technologies change how we interact online.
“Following President Bola Tinubu’s assent to the Nigeria Data Protection Bill on June 12, 2023, the NDPC has developed a framework to ensure its full implementation,” he said.
The directive, to be published on the NDPC portal, covers: Data protection principles, Lawful bases for data processing, Data subjects’ rights, Cross-border data transfers, Compliance audits and grievance redress mechanisms.
The NDPC also introduced the Standard Notice to Address Grievance (SNAG), a mechanism allowing individuals to demand remedial action from data controllers and processors before escalating complaints to the commission.
“This empowers over 230 million Nigerians to actively enforce their data protection rights,” Olatunji stated.
The directive’s full implementation will begin in September 2025, with a six-month transition period for organizations. Any fees associated with compliance will take effect from January 2026.
The NDPC assured Nigerians that it will continue to: Launch capacity-building initiatives to raise knowledge of data privacy and issue guidance notifications and advisories to elucidate legal obligations.
The commission underlined its commitment to ensure that international firms adhere to Nigeria’s data protection rules, protecting users’ privacy and personal information, in light of the continuing investigations into TikTok and Truecaller.