In a landmark enforcement action signaling Nigeria’s rising commitment to data sovereignty and digital rights, the Nigeria Data Protection Commission (NDPC) has fined MultiChoice Nigeria Limited a hefty ₦766,242,500 for violations of the Nigeria Data Protection Act (NDPA).
The fine—among the highest ever imposed under Nigeria’s data privacy regime—was issued after an extensive investigation revealed multiple breaches of subscriber privacy, including the unauthorised cross-border transfer of sensitive personal data of Nigerian citizens.
The Offence: Privacy Intrusions and Data Transfers Without Consent
According to Mr. Babatunde Bamigboye, Head of Legal, Enforcement and Regulations at the NDPC, the probe uncovered “deeply intrusive, unfair, unnecessary, and disproportionate data processing” practices by MultiChoice.
“MultiChoice not only violated the privacy rights of its subscribers but also collected and processed personal data of individuals not directly linked to its services,” Bamigboye said.
“More alarming was the unauthorised transfer of these personal data assets beyond Nigeria’s borders, in breach of national data sovereignty laws.”
The Legal Framework: What the Nigeria Data Protection Act Says
The Nigeria Data Protection Act (NDPA), enacted in 2023, aligns with global data governance standards such as the EU’s General Data Protection Regulation (GDPR). It mandates:
- Lawful basis for data processing (consent, contract, legal obligation)
- Data minimisation and purpose limitation
- Clear rules on international data transfer
- Penalties for non-compliance ranging into hundreds of millions of naira
MultiChoice was found to be in gross violation of several of these principles, especially in its data export operations and failure to adopt satisfactory remedial measures when flagged by regulators.
Remediation Failure and Lack of Cooperation
The NDPC confirmed that MultiChoice was invited to comply with remediation procedures under standard regulatory practice. However, the company’s responses were deemed “inadequate and unsatisfactory,” prompting the imposition of the fine.
“For want of cooperation and poor compliance with mandated remediation steps, the Commission has directed MultiChoice to pay ₦766,242,500 as a penalty,” Bamigboye stated.
The NDPC also announced that it would probe all MultiChoice data collection channels—online and offline—for possible systemic breaches, with further penalties on the table for any outlet found in non-compliance.
Expert Analysis: Nigeria Flexes Its Regulatory Muscle in Data Governance
The MultiChoice penalty marks a watershed moment in African digital regulation, positioning Nigeria as a regional leader in privacy enforcement. Legal analysts have praised the NDPC for not only issuing the fine but also invoking Section 37 of the Nigerian Constitution, which enshrines privacy as a fundamental right.
“This goes beyond corporate penalty—it’s a constitutional statement. Nigeria is asserting digital sovereignty and signalling to multinationals that it won’t tolerate reckless data exploitation,” said a leading Lagos-based tech law expert.
For businesses operating in Nigeria’s digital economy, the message is clear: privacy compliance is now a commercial risk and boardroom issue.
BRANDECONOMY Insight: Privacy is the New Currency in Nigeria’s Digital Economy
With over 150 million internet users, Nigeria is Africa’s largest digital market. Yet until recently, data protection enforcement had lagged behind. The MultiChoice fine is a turning point, and more companies will likely come under scrutiny in 2025 and beyond. However, the scale of the fine has raised many eyebrows regarding the issue of business sustainability in a seeming onslaught of punitive financial regulatory actions against businesses in Nigeria.
This enforcement action sends a clear signal:
- Data is no longer a free resource
- Consent is non-negotiable
- Cross-border transfers must meet legal thresholds
- Non-compliance carries financial and reputational risks
Forward-looking firms must now invest in privacy governance, including:
- Data audits and privacy impact assessments
- Transparent consent mechanisms
- Clear cross-border data policies
- Engagement with the NDPC to avoid costly penalties
