NDPC Orders Investigation into Temu Over Alleged Nigeria Data Protection Act Violations

NDPC has ordered investigation into Temu over alleged Nigeria Data Protection Act Violations.

 

NewsOnline Nigeria reports that Nigeria’s National Data Protection Commission (NDPC) has directed an immediate investigation into global e-commerce platform Temu over concerns that it may be mishandling user data in potential violation of the Nigeria Data Protection Act (NDPA).

 

The directive was disclosed by Vincent Olatunji, National Commissioner and Chief Executive Officer of the NDPC, who said preliminary findings point to possible infractions involving online surveillance practices, transparency and accountability gaps, data minimisation principles, duty of care obligations, and cross-border transfers of personal information.

 

ALSO: GTBank Launches Quick Airtime Loan at 2.95% via *737#, Offering Instant Airtime Credit Up to ₦10,000

 

The commission noted that the platform reportedly processes personal data belonging to approximately 12.7 million Nigerians, alongside an estimated 70 million daily users globally. The scale of operations has heightened regulatory scrutiny and amplified the significance of the probe.

 

In a statement, the NDPC warned that data processors acting on behalf of data controllers must independently verify compliance with the NDPA. Failure to do so, the agency said, could attract legal consequences, underscoring its resolve to enforce Nigeria’s data protection framework across digital platforms operating within the country.

 

Babatunde Bamigboye, Head of Legal, Enforcement and Regulations at the NDPC, emphasised that strict adherence to statutory requirements remains mandatory. He cautioned that confirmed violations could lead to formal enforcement actions in line with the commission’s regulatory mandate.

 

The investigation forms part of a broader review of foreign e-commerce platforms and their data governance practices, particularly concerning how users’ personal information is collected, stored, processed, and transferred across jurisdictions.

 

As of the time of reporting, Temu had not publicly responded to the NDPC’s directive.