NDPC probes UNILAG, Lotus Bank, Hackerbella over alleged student data violations

The Nigeria Data Protection Commission (NDPC) has launched a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and Hackerbella Ltd over allegations that students’ personal data was used to open bank accounts without a lawful basis.

The investigation follows public complaints concerning the collection, processing and use of students’ personal information by the three organisations.

Vincent Olatunji, NDPC’s national commissioner and chief executive officer, has directed an investigation team to establish the circumstances surrounding the collection, use and disclosure of the affected students’ personal data and determine the roles and responsibilities of each party.

The investigation will also assess the data protection compliance obligations of UNILAG, Lotus Bank and Hackerbella under the Nigeria Data Protection Act 2023 (NDP Act).

The commission noted that investigators will examine whether the processing of students’ data had a valid legal basis and whether the affected individuals were adequately informed about how their information would be used.

The probe will cover several areas, including Data Protection Impact Assessments (DPIAs), privacy notices, data-sharing arrangements, data minimisation, purpose limitation and data retention policies.

The NDPC will also examine any credit scoring or profiling activities involving the students, including the lawfulness and transparency of such practices, as well as the use of automated decision-making systems.

The adequacy of technical and organisational safeguards put in place to protect the rights of the affected data subjects will also form part of the investigation.

The commission said the investigation is intended to determine the potential risks posed to the rights and freedoms of the affected students and assess whether the organisations involved complied with their obligations as data controllers or processors.

The NDPC reiterated that educational institutions have a heightened responsibility when handling personal information belonging to students, staff and other members of their communities.

Read also: FG tasks directors with digital transformation of cooperative ecosystem

It stressed that such data must be processed lawfully, fairly, transparently and securely in accordance with Nigeria’s data protection framework.

The commission also issued a warning to educational institutions that have yet to comply with its existing data protection directives, urging them to take immediate steps to meet their obligations under the NDP Act.

The warning shows growing regulatory scrutiny of how educational institutions and their private-sector partners collect and share personal data, particularly where sensitive financial or profiling activities are involved.

Read Next

African venture funding hit decade-high $3.3bn in H1 as investors place larger bets on fewer companies

By Folake Balogun • August 11, 2026

Get Newsletter Updates

Enjoying our column?

Subscribe to our specialised **Tech Pulse** feed to receive fresh reports and analyses directly in your inbox.