-
The Nigeria Data Protection Commission has launched a forensic investigation into UNILAG, Lotus Bank and Hackerbella Ltd following allegations that students’ personal information was used to open bank accounts without lawful consent.
-
Investigators will determine how the students’ data were collected, shared and processed, while establishing the roles and possible liabilities of each organisation under the Nigeria Data Protection Act, 2023.
-
The probe will examine data-sharing agreements, automated profiling, privacy notices, lawful processing, data retention policies and security safeguards to determine whether the rights of affected students were violated.
-
NDPC has warned universities and other educational institutions to comply fully with data protection regulations, stressing that failure to safeguard personal information could attract regulatory sanctions.
August 12, (THEWILL) — A major data privacy controversy has erupted around the University of Lagos (UNILAG) after the Nigeria Data Protection Commission (NDPC) announced a forensic investigation into the institution, Lotus Bank and Hackerbella Ltd over allegations that students’ personal information was used to open bank accounts without their lawful consent.
The commission disclosed on Wednesday that the investigation was triggered by public complaints alleging that sensitive personal data belonging to students were processed without a lawful basis, raising concerns over possible violations of the Nigeria Data Protection Act (NDPA), 2023.
Announcing the development in Abuja, the NDPC’s Head of Legal, Enforcement and Regulations, Mr Babatunde Bamigboye, said the National Commissioner and Chief Executive Officer of the commission, Vincent Olatunji, had constituted an investigation team to conduct a comprehensive forensic assessment of the allegations.
According to Bamigboye, the exercise will establish the circumstances surrounding the collection, processing, use and disclosure of the affected students’ personal information, while determining the respective roles and responsibilities of UNILAG, Lotus Bank and Hackerbella Ltd in the alleged data processing activities.
He explained that investigators would also evaluate whether the organisations complied with their obligations under the Nigeria Data Protection Act, particularly regarding the lawful handling of personal information entrusted to them.
“The investigation will assess the general data protection compliance obligations of the parties in line with the Nigeria Data Protection Act, 2023, and examine any potential risks posed to the rights and freedoms of the affected data subjects”, Bamigboye said.
The commission stated that the probe would extend beyond the immediate allegations to examine whether mandatory Data Protection Impact Assessments (DPIAs) were conducted before the processing activities commenced.
It added that investigators would scrutinise the lawfulness and transparency of any credit scoring or profiling activities, as well as the deployment of automated decision-making systems that may have been used during the processing of students’ personal information.
The NDPC further disclosed that the investigation would review the adequacy of privacy notices issued to students, the existence and legality of data-sharing arrangements among the parties, the lawful basis relied upon for processing personal data, compliance with the principles of data minimisation and purpose limitation, retention policies and the technical and organisational measures put in place to protect the rights of data subjects.
The commission noted that the findings would help determine whether the processing activities exposed affected students to privacy risks or infringed on their legally protected rights under Nigeria’s data protection framework.
READ ALSO:Â Tinubu Appoints Ex-UNILAG VC Ogundipe As NUC Governing Board Chairman
NDPC Warns Schools As Enforcement Tightens
![Split image: left shows the University of Lagos entrance with its emblem; right shows a white double door beside a data privacy policy banner.] ,Oops](https://thewillnews.com/wp-content/uploads/2026/08/UNILAG-and-NDPC.jpg "UNILAG and NDPC - THEWILL NEWS MEDIA")
Reiterating the obligations of educational institutions, Bamigboye stressed that universities and other schools entrusted with the personal information of students, staff and members of their communities must ensure such data are processed lawfully, fairly, transparently and securely.
He warned institutions that have yet to comply with existing NDPC data protection directives to do so without delay, emphasising that compliance with the law is critical to safeguarding individual privacy rights and promoting responsible data governance within Nigeria’s education sector.
The Nigeria Data Protection Act, 2023 established the Nigeria Data Protection Commission as the country’s primary regulator responsible for protecting the privacy rights of individuals and enforcing compliance with data protection obligations across public and private institutions. The law requires organisations to process personal information only on recognised lawful grounds, implement adequate security safeguards, maintain transparency and ensure that personal data are collected only for legitimate purposes.
Felix Ifijeh is a journalist with years of professional reporting experience. Known for his keen news sense, compelling storytelling and commitment to accurate, impactful reporting, he has built a reputation for turning leads into clear, engaging, and well-structured reports that resonate with readers. His work reflects deep newsroom experience and a commitment to accurate, impactful journalism.
