The Nigeria Data Protection Commission (NDPC) has started an investigation into the data processing practices of Tiktok and Truecaller, following growing concerns about potential privacy violations.
Dr. Vincent Olatunji, the Chief Executive Officer of the NDPC, made the announcement today during a press conference in Abuja, where he also revealed the issuance of the Nigeria Data Protection Act – General Application and implementation directive (NDPC Act – GAID), 2025.
He stated that the commission’s primary concern is how these platforms manage Nigerian users’ personal data, including potential breaches of consent, data sharing with third parties, and overall compliance with the Nigeria Data Protection Act (NDPA), 2023. He confirmed that the NDPC is actively investigating Tiktok and Truecaller’s data processing activities to ensure they comply with Nigeria’s data protection laws.
“The goal is to safeguard the privacy rights of Nigerians and hold organizations accountable for how they collect, store, and use personal data,” he added.
This investigation comes amid increasing scrutiny of global tech companies regarding data privacy, especially concerning how personal information is processed, stored, and transmitted beyond national borders.
The NDPC act – GAID, 2025, issued today, provides a detailed framework for implementing Nigeria’s data protection law, outlining compliance guidelines, enforcement mechanisms, and obligations for both public and private organizations.
Dr Olatunji emphasized that the directive aims to strengthen Nigeria’s digital economy by fostering trust in data governance while ensuring individuals’ rights to privacy are respected in accordance with international best practices. He reiterated that companies operating in Nigeria must comply with the country’s data protection regulations or face regulatory actions, including fines and potential restrictions.
The NDPC has urged the public to report any data privacy violations and reaffirmed its commitment to transparency and due process in its investigations. The commission noted that reporting data breaches has become more accessible through dedicated channels on its official website.
