About 48 hours after FIJ reported regulatory silence on the data breach involving Remita Payment Services Ltd., the Nigeria Data Protection Commission (NDPC) confirmed it is investigating the incident.
In a press release issued on Sunday, the commission said it is probing Remita, Sterling Bank and other unnamed entities over the breach.
The NDPC stated that a Notice of Investigation had already been served on the affected organisations in April and that “relevant parties and individuals” are currently providing information as part of its inquiry.
According to the regulator, the investigation will focus on the categories of personal data involved, the nature and scope of the breach, the level of risk posed to data subjects and any mitigation measures taken where a breach is confirmed.
The commission also signalled that the probe may extend beyond the immediate case. Dr. Vincent Olatunji, the National Commissioner and CEO, said that organisations operating digital payment systems without adequate technical and organisational safeguards, as required under the Nigeria Data Protection Act, would be examined as part of a broader enforcement effort.
Sunday’s statement is the first official acknowledgement from the regulator since FIJ’s report. Here is the statement in full:
NDPC (Nigeria Data Protection Commission) – Press Release (5th of April, 2026)
The Nigeria Data Protection Commission (NDPC) is carrying out an investigation into an alleged data breach involving Remita Payment Services Ltd., Sterling Bank and other entities. In line with the Commission’s procedure, Notice of Investigation was duly served on the list of April, 2026. Relevant parties and individuals have been providing information for the purpose of addressing the inquiry.
The aim of the investigation is to ensure that data subjects are protected with appropriate technical and organisational measures. The investigation by NDPC covers, among others, the types of personal data involved, the nature and scope of the alleged breach, the risk to data subjects and the mitigation measures carried out where a breach is confirmed.
The Commission’s National Commissioner/CEO, Dr Vincent Olatunji, has directed that organisations that employ digital payment systems without putting in place appropriate technical and organisational measures as mandated under the Nigeria Data Protection Act, 2023 (NDPC), will also be examined as part of a wider effort to ensure the integrity of the ecosystem.
Signed
BABATUNDE BAMIGBOYE ESQ. QDPRP
HEAD, LEGAL, ENFORCEMENT & REGULATIONS
