NDPC opens forensic probe into UNILAG, Lotus Bank over students' accounts

The Nigeria Data Protection Commission has launched a forensic investigation into the University of Lagos, Lotus Bank and Hackerbella Ltd over alleged data violations. The probe follows public complaints that students' personal data were used to open bank accounts without their knowledge or consent.

Investigation triggered by public complaints

Babatunde Bamigboye, head of legal, enforcement and regulations at the NDPC, announced the development in a statement issued on Wednesday, August 12, 2026, in Abuja. He said the probe was triggered by public complaints alleging unlawful use of students' data. National Commissioner Vincent Olatunji personally directed the investigation team to carry out a full assessment of how the affected students' data was collected, used and shared.

What the probe will cover

The inquiry will establish the specific roles played by each of the three organisations in the alleged data processing. It will measure their conduct against obligations in the Nigeria Data Protection Act, 2023.

Bamigboye said: "The investigation will, among others, cover Data Protection Impact Assessments (DPIAs), the lawfulness and transparency of any credit scoring or profiling activities, and the use of automated decision-making systems. It will also examine the adequacy of privacy notices, data-sharing arrangements, lawful bases for processing, data minimisation, purpose limitation, retention policy, and appropriate technical and organisational safeguards for data subjects' rights."

Investigators will also look at the potential risks the alleged breach poses to the rights and freedoms of the students whose data is believed to have been compromised.

Warning to institutions

Beyond UNILAG, the NDPC used the announcement to put other educational institutions on notice. Bamigboye warned that any institution yet to comply with the commission's existing data protection directives must do so without further delay. He said organisations that hold the personal data of students, staff and community members carry a legal and ethical duty to handle that information lawfully, fairly, transparently and securely. Bamigboye added that compliance with data protection regulations was not optional, describing it as essential to defending the rights of data subjects and building responsible data governance across the education sector.

Recall that the NDPC earlier launched an immediate probe into e-commerce platform Temu over alleged violations of the country's data privacy law. The commission also launched a Know-Your-Data-Rights campaign to educate the public. The campaign warned Nigerians to be careful when surfing the internet or shopping online, and to avoid opening strange mails or clicking strange links. NDPC noted that such actions from users could compromise data safety and lead to huge losses.

For Nigerian students and bank customers, this probe signals that regulators are watching how personal information is handled. It also reminds schools and financial institutions to review their data practices or face enforcement action.