Nigeria’s data protection regulator, the Nigeria Data Protection Commission (NDPC), has commenced a sweeping probe into the data processing operations of global e-commerce platform Temu, amid concerns over possible breaches of the Nigeria Data Protection (NDP) Act.
The National Commissioner and Chief Executive Officer of the Nigeria Data Protection Commission (NDPC), Dr. Vincent Olatunji, directed the immediate investigation following allegations that the company’s handling of personal data may contravene statutory provisions governing privacy and data governance in Nigeria.
In a statement signed by Babatunde Bamigboye Esq., Head, Legal, Enforcement and Regulations at the NDPC, and made available the Digital TimesNG, the Commission said the inquiry was triggered by issues bordering on online surveillance through personal data processing, compliance with accountability obligations, adherence to data minimisation principles, transparency requirements, duty of care standards, and the legality of cross-border data transfers.
Preliminary findings indicate that Temu processes the personal information of approximately 12.7 million data subjects in Nigeria. Globally, the platform reportedly records about 70 million daily active users, underscoring the scale and potential implications of its data processing footprint.
The statement quoted Dr. Olatunji as emphasising that the Commission would rigorously enforce compliance with the NDP Act, warning that data processors who undertake processing activities on behalf of data controllers without verifying their compliance status may themselves be held liable under the law.
“The NDP Act imposes clear obligations not only on data controllers but also on processors. Any entity involved in personal data processing must ensure full compliance with statutory requirements,” the NDPC said in the statement.
The NDPC reaffirmed its commitment to safeguarding the privacy rights of Nigerians and ensuring that organisations operating within or targeting the Nigerian market adhere strictly to established data protection standards.