NDPC Launches Forensic Probe of UNILAG, Lotus Bank, Hackerbella Over Alleged Student Data Violations

Commission investigates claims that students’ personal data was used to open bank accounts without consent

The Nigeria Data Protection Commission, NDPC, has launched a forensic investigation into the University of Lagos, UNILAG, Lotus Bank, and technology firm Hackerbella Limited over alleged breaches of the Nigeria Data Protection Act, 2023.

The Commission said the probe was triggered by public complaints alleging that students’ personal data was used to open bank accounts without a lawful basis.

—What the NDPC is Investigating—

In a statement issued on Wednesday, August 12, 2026, the NDPC Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, said the National Commissioner, Dr. Vincent Olatunji, had directed a full assessment of how the affected students’ data was collected, used, and disclosed.

According to Bamigboye, the investigation team will:
– Determine roles and responsibilities of each party involved in the alleged data processing

– Assess compliance obligations under the NDP Act, 2023

– Examine risks posed to the rights and freedoms of the affected data subjects

Specifically, the probe will cover:
– Data Protection Impact Assessments, DPIAs

– Lawfulness and transparency of any credit scoring or profiling activities

– Use of automated decision-making systems

– Adequacy of privacy notices and data-sharing agreements

– Lawful basis for processing, data minimisation, and purpose limitation

– Data retention policies

– Technical and organisational safeguards for protecting data subjects’ rights

—“Institutions Must Ensure Lawful Processing”—

Bamigboye warned that institutions entrusted with the personal data of students, staff, and other community members have a legal duty to ensure such data is processed lawfully, fairly, transparently, and securely.

He also issued a fresh compliance notice to educational institutions that are yet to align with NDPC directives.

NCAA Orders Arrest of Air Peace Driver For Alleged Runway Blockade During Labour Picket

“Compliance with data protection regulations is essential to safeguarding the rights and freedoms of data subjects and promoting responsible data governance within the education sector,” he said.

The investigation comes amid growing concerns over the misuse of personal data in Nigeria’s financial and education sectors, particularly around Know-Your-Customer, KYC, processes for opening bank accounts.

As of press time, UNILAG, Lotus Bank, and Hackerbella Limited had not issued official responses to the allegations.

The NDPC said it would make its findings public upon conclusion of the forensic assessment.