Nigeria: NDPC issues its first significant fine under the NDPA
The NDPC has fined a Nigerian fintech 50 million naira for violations of the Nigeria Data Protection Act. It is the first substantive sanction since the NDPA came into force in 2023.
Severity
2Affected country
NGSector
Banking & fintechPublished
26 May 2026
Our score measures operational relevance to Africa — not the global virality of the story.
Contents · 5
The decision
On May 22, 2026, the Nigeria Data Protection Commission (NDPC) published an enforcement decision against Kredify, an instant credit fintech operating in Lagos, for violations of several provisions of the Nigeria Data Protection Act (NDPA) 2023.
The fine amounts to 50 million naira (approximately $31,000 at the current exchange rate). The sum is symbolically significant: it is the first public and consequential sanction issued under the new NDPA regime, which replaced the 2019 NDPR.
The violations upheld
Three breaches were upheld against Kredify:
1. Excessive data collection. Kredify required access to users' full phone contacts, photo gallery and call history. This data was used for aggressive debt collection practices — contacting defaulting borrowers' relatives.
2. No legal basis for data sharing. Kredify shared its clients' credit data with seven partners without a documented legal basis or prior user notification.
3. Response delay on access requests. The NDPC found that Kredify systematically ignored personal data access requests, in violation of Article 34 of the NDPA which requires a 72-hour response deadline.
Why this decision matters
This fine establishes a clear precedent: the NDPC is prepared to sanction fintechs for practices that were until now tolerated or ignored.
The targeted practices — contact collection for debt recovery, unconsented sharing with third parties — are extremely widespread in the West African digital lender ecosystem. Carbon, FairMoney, PalmCredit and several dozen other players use similar mechanics.
Implications for the ecosystem
For fintechs operating in Nigeria, the immediate compliance priorities are:
— Review permissions requested at mobile application installation. — Document the legal basis for every data processing activity shared with third parties. — Implement a process to respond to access requests within 72 hours. — Cease any practice of contacting third parties (family, colleagues) in debt collection operations.
The regional signal
Nigeria's NDPC is becoming the first data protection authority in sub-Saharan Africa to issue significant public sanctions. Senegal's PDPC and Côte d'Ivoire's CIPD are watching the precedent. A wave of forced compliance in West African fintechs is likely within the next 12 to 18 months.
— ◆ —