Nigeria Turns a Recovered Corruption Asset Into NDPC Headquarters — Why It Matters for Data Protection and Digital Fraud

A property recovered through Nigeria's fight against corruption has been given an unusually symbolic second purpose: protecting Nigerians' personal data.

The Federal Government has commissioned a new permanent headquarters for the Nigeria Data Protection Commission (NDPC) in Abuja after President Bola Tinubu approved an EFCC-recovered property for the regulator. Communications, Innovation and Digital Economy Minister Bosun Tijani said the building had effectively been returned to productive public use. It makes for a compelling political symbol. But for ordinary Nigerians, the more important question is whether a better-resourced NDPC can translate its new institutional strength into better protection when companies, government agencies and digital platforms collect and process their data.
That matters because stolen or poorly protected personal information can become raw material for fraud, impersonation and increasingly convincing scams.

Nigeria Now Has a Stronger Data Regulator

The NDPC received a much stronger statutory foundation when President Tinubu signed the Nigeria Data Protection Act 2023 into law. The government has also directed federal Ministries, Departments and Agencies to comply with applicable data-protection requirements.
The commission's responsibilities include regulating personal-data processing, investigating complaints and suspected violations, promoting compliance and protecting the privacy rights of data subjects.

This isn't just theoretical enforcement. In April 2026, the NDPC opened an investigation into an alleged breach involving Remita, Sterling Bank and other entities after reports circulated that threat actors claimed to possess sensitive customer and institutional data. The regulator said its investigation would seek to determine what information was affected and the potential risks to individuals.

The same month, the commission investigated an alleged breach involving the Corporate Affairs Commission after reports concerning its information systems.

In August, it also opened a forensic investigation involving the University of Lagos, Lotus Bank and Hackerbella following complaints alleging students' personal information had been used to open bank accounts without a lawful basis. The allegations remain subject to the investigation.

These cases demonstrate why the NDPC's institutional capacity matters more than the building itself.

Data Protection Is Also Part of the Fight Against Scams

The NDPC isn't Nigeria's general anti-fraud police. Agencies including the EFCC, law-enforcement authorities and cybersecurity institutions have different responsibilities. But data protection sits much closer to scam prevention than it may initially appear.

Think about what makes a sophisticated phishing message convincing.
Your full name. Your phone number. Your employer. Your bank. Your email address. Perhaps information about a transaction or organisation with which you recently interacted. The more accurate information criminals have, the easier it becomes to create a message that looks legitimate.

TechView Africa recently analysed documented Nigerian scam-message patterns and found that fraudsters frequently use fear, urgency, authority, promised rewards and manufactured trust to pressure victims into acting before they verify a claim. Personal information can make those persuasion techniques considerably more convincing.

A generic message saying “your account has a problem” is suspicious. A message containing your correct name, institution and other personal details can feel very different. That is why organisations protecting customer databases properly isn't merely a compliance exercise.
It is part of the country's wider cybersecurity defence.

Nigeria's Fraud Numbers Show Why This Matters

Nigeria recorded 67,518 reported digital-payment fraud incidents in 2025, according to NIBSS figures reviewed by TechView Africa. Reported losses fell from ₦52.26 billion in 2024 to ₦25.85 billion in 2025, although the unusually high 2024 figure was significantly affected by one ₦31.1 billion incident.

More revealing may be the techniques being used. TechView Africa reviewed 11 selected ngCERT advisories published between April 30 and September 2, 2026. Phishing or social engineering appeared in eight, while credential theft or account compromise also appeared in eight. Four referenced AI in connection with attack techniques or deception. That review is not a prevalence survey of all Nigerian scams, but it shows how prominently identity and manipulation feature in current threat warnings.

The NDPC itself issued a cybersecurity advisory in April after its technical assessment identified malicious actors targeting financial systems and critical digital infrastructure.

This creates an important connection. Nigeria cannot build a safer digital-payment economy solely by teaching consumers not to click suspicious links. The organisations holding millions of records also have to minimise unnecessary collection, secure the information they retain and respond properly when breaches occur.

Data Protection Could Matter Even More in the AI Era

Artificial intelligence raises the stakes. AI systems can process enormous quantities of information, while generative tools can make impersonation and social-engineering content faster and cheaper to produce.

At the NDPC headquarters commissioning, Tijani argued that privacy, data governance and responsible technology use would become increasingly important as AI becomes more deeply embedded in Nigeria's economy. That means regulators increasingly have to think beyond a traditional database being hacked.

Questions now include whether organisations collected data lawfully, whether they collected more than necessary, how information is shared with AI systems, whether customers understand how their information is being processed and what happens when third-party processors gain access.

For misinformation, the relationship is less direct. The NDPC is not a general misinformation regulator. But privacy regulation can matter where personal information is unlawfully harvested or processed to profile, impersonate or target individuals with deceptive content.

That distinction is important. A stronger NDPC will not make fake information disappear from Nigerian social media. But stronger controls over personal-data collection and processing can reduce some of the information vulnerabilities that make targeted manipulation possible.

A Recovered Building Is Symbolic — Enforcement Is the Real Test

The commission has expanded significantly. NDPC Commissioner Vincent Olatunji said the regulator has licensed 356 Data Protection Compliance Organisations, while activities around the commission and those organisations have contributed to more than 27,000 jobs over three years. He also said more than 66,000 people had enrolled in its Virtual Privacy Academy and that the broader Nigerian data-protection ecosystem was valued above ₦18 billion. These are figures reported by the commission itself.
Tijani also said ICT's contribution to Nigerian GDP had risen from roughly 16% to around 21% over three years. That is the minister's figure and attribution; it should not be confused with an independently established measure of the entire “digital economy,” which can be defined differently.

As more banking, healthcare, commerce and government services move online, more valuable personal information will inevitably sit inside digital systems. The real measure of the NDPC's new chapter therefore won't be the size of its Abuja headquarters. It will be whether Nigerians see faster investigations when breaches occur, meaningful consequences for organisations that mishandle personal information, stronger security practices before breaches happen, clearer communication to affected citizens and practical ways for ordinary people to seek redress.

The commission already provides an online mechanism through which people can report data breaches and privacy violations. NDPC Data Breach Reporting Portal

There is something fitting about an asset recovered through an anti-corruption process becoming the home of an institution tasked with accountability in another area.
But the symbolism will matter only if institutional capacity follows it. Nigeria's digital economy is becoming larger, AI is making information easier to process, and fraudsters are becoming better at turning identity and trust against their victims.

The next test for the NDPC is therefore not simply protecting data on paper. It is making poor handling of Nigerians' personal information increasingly difficult, detectable and consequential.

Read more: Data Privacy Concerns Grow as AI Continues to Advance
Read more: AI Is Making Misinformation More Dangerous — Africa Needs to Prepare
Read more: EU Tells Advanced-AI Companies to Get Their Models Under Control — But Can Europe Actually Stop One?
Read more: Anthropic Researcher Quits and Warns AI Could ‘Kill Us All’ — Recent Incidents Are Fueling His Fear