NDPC Probes Unilag, Lotus Bank over Student Data Use

In Short

Nigeria’s data regulator has opened a forensic investigation into claims that UNILAG students’ data was used to open bank accounts without permission.

What Happened

The Nigeria Data Protection Commission, NDPC, has started a forensic investigation into the University of Lagos, Lotus Bank, and tech company Hackerbella Ltd.

The probe follows public complaints alleging that students’ personal data was used to open bank accounts without their knowledge or a lawful basis. A lawful basis is a legally valid reason to process data, such as consent or a contract.

NDPC’s Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, said the National Commissioner, Dr. Vincent Olatunji, ordered a broad assessment of how the students’ data was collected, used, and shared.

The investigation will review compliance with the Nigeria Data Protection Act 2023. It will also map the roles and responsibilities of each party involved in the alleged data processing.

Bamigboye said NDPC will examine whether a Data Protection Impact Assessment was done. That is a documented risk check, like a safety inspection, for activities that could harm people’s privacy.

The commission will also look into any credit scoring or profiling, meaning using data to predict a person’s behaviour or credit risk. It will review any automated decision-making systems, which are software-driven choices made with limited human input.

NDPC said it will assess privacy notices, data-sharing agreements, data minimisation, purpose limitation, how long data is kept, and security safeguards.

Why It Matters

If students’ details were used to open accounts without consent, it could point to weak data governance in education-to-finance onboarding flows.

For banks and campus-linked account drives, the case raises questions about transparency, consent capture, and third-party vendor controls. For Nigerian schools, NDPC is signalling tougher enforcement and wider scrutiny across the education sector.

The NDPC also warned other educational institutions that have not complied with its data protection directives to do so, or face regulatory action.