NDPC Launches Probe Into Alleged CAC Data Breach, Moves To Tighten Guardrails

The Nigeria Data Protection Commission (NDPC) has opened an investigation into an alleged data breach at the Corporate Affairs Commission (CAC), citing its powers under Section 46(3) of the Nigeria Data Protection Act, 2023.

The Commission said the probe underscores the need to sustain trust in Nigeria’s economic environment amid rising threats from actors in the digital space.

In a statement signed by Babatunde Bamigboye, Esq., Head, Legal, Enforcement & Regulations, NDPC, the Commission expressed concern that threat actors have devised malicious methods of compromising the data security architecture of key databases. These methods, it noted, involve large-scale data exfiltration and cross-platform compromise across interconnected systems.

National Commissioner/CEO of the NDPC, Dr. Vincent Olatunji, has directed the Commission’s technical team to immediately interface with relevant authorities and pivotal organisations. The move is part of a continuum of regulatory support measures aimed at reinforcing existing guardrails for the processing of personal data.

The NDPC said the investigation will cover, among other areas, the procedures and outcomes of Access Control Mechanisms, Data Privacy Impact Assessments, Vulnerability Assessment and Penetration Testing (VAPT), as well as due diligence on third-party data processors.

Despite the reported breach, the Commission assured the public that frameworks for data protection in Nigeria remain fundamentally strong in terms of technology and other requisite resources. It pointed to the increasing rate of access to data-driven services as evidence of that strength.

“The ongoing efforts of the NDPC are necessary regulatory actions geared towards sustaining public trust in these services and bolstering continuous investment in Nigeria’s digital economy,” the statement read.

The CAC is a key agency responsible for the registration and regulation of companies in Nigeria, holding extensive corporate and personal data on millions of entities and individuals.

The NDPC did not disclose the scale of the alleged breach or when it occurred, but said its investigation will determine lapses and recommend corrective measures.