NDPC Investigates Remita, Sterling Bank Over Data Breach, Signals Stricter Enforcement

By Ayo Susan

The Nigeria Data Protection Commission (NDPC) has initiated an investigation into an alleged data breach involving Remita Payment Services Limited, Sterling Bank, and other unnamed entities within the digital payments ecosystem.

The Head of Legal, Enforcement and Regulations at the NDPC, Barr. Babatunde Bamigboye, confirmed that formal notices were issued on April 1, with affected organisations already engaging the commission through information disclosures.

DECISION HIGHLIGHT
The commission is undertaking a full-spectrum regulatory review, focusing on the nature of exposed personal data, breach scope, risk implications for data subjects, and adequacy of institutional response frameworks.

The National Commissioner of the NDPC, Mr. Vincent Olatunji, reinforced the enforcement posture, noting that compliance with the Nigeria Data Protection Act 2023 is non-negotiable and subject to intensified scrutiny.

DECISION MEMO
The investigation reflects a transition from declarative regulation to active enforcement within Nigeria’s data governance architecture. The NDPC is moving to operationalise statutory authority by testing compliance under live breach conditions rather than relying on self-reporting or passive oversight.

The inclusion of major financial and payment institutions indicates that regulatory focus has shifted towards systemically important data processors, where breaches carry broader implications for financial stability and public trust.

Bamigboye’s emphasis on technical and organisational safeguards suggests that compliance is being evaluated not merely on policy documentation but on functional resilience, incident response capability, and risk containment.

Olatunji’s position introduces a forward signal, enforcement will extend beyond the current case to a wider compliance sweep across digital platforms. This effectively raises the regulatory baseline, particularly for fintech and banking institutions operating high-volume data systems.

The underlying issue is institutional maturity. Nigeria’s digital economy has expanded rapidly, but governance structures have lagged. The commission’s intervention seeks to correct this imbalance by aligning operational practices with statutory requirements.

DATA BOX

• Investigation notices issued: April 1
• Regulatory framework: Nigeria Data Protection Act 2023
• Entities involved: Remita Payment Services Limited, Sterling Bank, others unnamed

WHO WINS / WHO LOSES
Data subjects stand to benefit from strengthened safeguards and increased accountability across digital platforms.

Regulators consolidate authority and credibility through visible enforcement actions.

Non-compliant institutions face reputational exposure, potential sanctions, and increased compliance costs.

Smaller operators with weak governance frameworks may experience disproportionate regulatory pressure.

POLICY SIGNALS
The action signals a clear shift towards enforcement-led regulation, where compliance is actively tested and violations are pursued.

It also indicates a policy priority on data sovereignty and consumer protection as foundational elements of Nigeria’s digital economy.

INVESTOR SIGNAL
The tightening regulatory environment introduces higher compliance thresholds for fintech and financial services firms.

While this may increase operational costs, it also strengthens system integrity, which is critical for long-term capital confidence in Nigeria’s digital infrastructure.

RISK RADAR
Immediate risks include reputational damage, legal exposure, and potential financial penalties for implicated entities.

Systemic risk lies in the possibility of wider compliance gaps across the ecosystem, which could trigger broader regulatory interventions.

There is also execution risk for the regulator, sustained enforcement will require institutional capacity to investigate, adjudicate, and monitor compliance at scale.