NDPC Launches Probe into Suspected CAC Data Breach Under 2023 Data Protection Act

**TL;DR** The Nigeria Data Protection Commission (NDPC) has launched an investigation into a suspected data breach at the Corporate Affairs Commission (CAC), invoking the Nigeria Data Protection Act 2023.

Nigeria’s digital ecosystem faces a critical test following a suspected data breach at the Corporate Affairs Commission (CAC). The CAC maintains a central registry for company information, making its data a high-value target for malicious actors. This incident highlights the enforcement powers of the Nigeria Data Protection Act 2023, a landmark legislation designed to protect citizens' personal data.

The Nigeria Data Protection Commission confirms it initiated a formal investigation into the breach. Mr. Babatunde Bamigboye, Head of Legal, Enforcement and Regulations at the NDPC, states the probe operates strictly under the provisions of the Nigeria Data Protection Act 2023. Dr. Vincent Olatunji, National Commissioner of NDPC, directed the technical team to scrutinize several critical areas. This includes evaluating access control systems, conducting comprehensive vulnerability assessments, and verifying compliance with established data privacy regulations. The review will also assess any third-party data processors involved, ensuring they meet required security standards.

For Nigerian organizations, this investigation serves as a stark reminder of escalating cyber threats and the NDPC's commitment to enforcement. The incident underscores the need for robust cybersecurity postures, particularly for entities handling sensitive public data. Organizations must prioritize continuous vulnerability management, implement strong access control policies, and regularly audit third-party vendor security. Regular employee training on data protection protocols and incident response planning are crucial defensive measures. Compliance with the Nigeria Data Protection Act 2023 is no longer optional; the NDPC's actions demonstrate a clear regulatory intent to hold organizations accountable for data stewardship. All entities operating within Nigeria's digital space should closely monitor the investigation's findings, as these will likely shape future enforcement actions and compliance expectations under the Act.