On July 6, 2025, the Nigeria Data Protection Commission (NDPC) imposed a record-breaking ₦766.242 million fine on Multichoice Nigeria, citing significant breaches of the Nigeria Data Protection Act (NDP Act). This penalty marks the largest single fine issued under the Act since its implementation in 2023.
Table of Contents
Investigation Timeline and Trigger
The NDPC’s investigation commenced in Q2 2024 after receiving credible reports alleging:
- Unauthorized collection and unlawful processing of subscriber data and that of their associates;
- Improper cross-border transfers of sensitive personal information belonging to Nigerians
Babatunde Bamigboye, Head of Legal, Enforcement & Regulations at NDPC, revealed that the investigation uncovered intrusive data practices, affecting individuals beyond Multichoice’s direct clientele.
Key Findings: Intrusive Processing & Unlawful Transfers
The NDPC’s probe identified multiple infractions:
- Unlawful Data Collection: Multichoice collected personal information from both subscribers and non-subscribers without proper authorization;
- Cross‑Border Data Transfers: Subscriber data was transferred outside Nigeria without legal grounds;
- Intrusive Processing: The scale and depth of data gathering were deemed “patently intrusive, unfair, unnecessary and disproportionate,” violating Section 37 of the 1999 Constitution, which guarantees the right to privacy.
NDPC emphasized that these findings represent a serious encroachment on Nigeria’s data sovereignty and pose potential risks to national security, economic stability, and legal systems.
Attempts at Remedy — and Shortcomings
Following standard protocol, the NDPC issued formal remediation directives, instructing Multichoice Nigeria to strengthen its data privacy frameworks. However, these interventions were deemed insufficient and uncooperative, leading to enforcement escalation.
In Bamigboye’s words: “For want of cooperation, the Commission has directed Multichoice to pay N766,242,500 for violating the Nigeria Data Protection Act.”
Unprecedented Penalty Under the NDP Act
This fine constitutes the largest financial penalty ever levied by the NDPC since the Act became enforceable in 2023. Previously, the commission opted to pursue remediation over punitive measures. However, the scale and seriousness of Multichoice’s non-compliance necessitated a harsher response to uphold public trust and regulatory integrity.
Beyond the Fine: Nationwide Audit of Data Channels
NDPC’s National Commissioner, Dr. Vincent Olatunji, has mandated a full compliance audit of all platforms and outlets in Nigeria through which Multichoice collects personal data. The warning was clear: any entity processing data in breach of the Act is liable for sanctions.
Why This Ruling Matters
- Data sovereignty enforcement: Establishes Nigeria’s commitment to protecting digital privacy and asserting jurisdiction over cross-border data practices.
- Regulatory deterrence: Serves as a warning to multinational firms that non-cooperation and inadequate compliance will result in significant financial penalties.
- Investor reassurance: Balances the need for robust data regulation with assurances to investors that Nigeria is building a transparent, accountable digital ecosystem.
Potential Fallout for Multichoice
Though Multichoice Nigeria is yet to issue a public rebuttal, the ramifications of the fine could include:
- Reputational damage: Subscribers and partners may question the company’s information‑handling ethics.
- Operational costs: Enhancements to data security systems, staff training, and compliance oversight will require investment.
- Regulatory follow-up: Heightened scrutiny and possible further investigations as recommended by NDPC.
Sector‑Wide Message: Data Privacy Is Non-Negotiable
The NDPC appears to be increasing enforcement rigour. Earlier this year, the commission cautioned that heavy penalties were on the horizon for non-compliant data controllers.
Recent fines, including the N555.8 million penalty imposed on Fidelity Bank for PDPA violations, confirm this trajectory.
What Comes Next
- Multichoice Response: Likely legal review and possible appeal, akin to its earlier contestation of unrelated penalties.
- Compliance Overhaul: Investments in consent protocols, data-localization mechanisms, and third-party audits.
- Broader Corporate Impact: Other tech platforms and telecoms may preemptively reinforce their privacy frameworks to avoid similar outcomes.
Conclusion: A Milestone for Nigerian Data Protection
The NDPC’s decision to fine Multichoice Nigeria ₦766.2 million signals a pivotal moment in Nigeria’s ongoing data-privacy transformation. It reaffirms that data-protection compliance is paramount, not optional—even for market leaders.
This judgment sends a powerful reminder: in an increasingly data-driven landscape, regulatory diligence and ethical data stewardship are not just legal obligations but essential components of maintaining consumer trust and business resilience.
Join Our Social Media Channels:
WhatsApp: NaijaEyes
Facebook: NaijaEyes
Twitter: NaijaEyes
Instagram: NaijaEyes
TikTok: NaijaEyes
