The Nigeria Data Protection Commission (NDPC) has commenced a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and Hackerbella Ltd over allegations that students’ personal data were used to open bank accounts without a lawful basis.
Babatunde Bamigboye, Head of Legal, Enforcement and Regulations at the NDPC, disclosed this in a statement posted on X dated Tuesday, 11th of August 2026.
Bamigboye said the investigation followed public complaints alleging that the personal data of students were used to open bank accounts without their data being lawfully processed.
He said Vincent Olatunji, National Commissioner of the NDPC, had directed the investigation team to conduct a comprehensive assessment of the circumstances surrounding the collection, use and disclosure of the affected students’ personal data.
The investigation will also determine the respective roles and responsibilities of UNILAG, Lotus Bank and Hackerbella in the alleged processing of the data.
According to the commission, the probe will assess the compliance of the three organisations with obligations under the Nigeria Data Protection Act, 2023.
“The investigation will, among others, cover Data Protection Impact Assessments (DPIAs), the lawfulness and transparency of any credit scoring or profiling activities, and the use of automated decision-making systems,” the statement reads.
The investigation will also examine the adequacy of privacy notices, data-sharing arrangements and the lawful bases for processing the students’ information.
Other areas of focus include data minimisation, purpose limitation, retention policies and the technical and organisational safeguards put in place to protect data subjects’ rights.
Bamigboye said the investigation would further examine the potential risks posed to the rights and freedoms of the affected students.
NDPC reiterated that institutions entrusted with the personal data of students, staff and other members of their communities had a responsibility to ensure that such information was processed lawfully, fairly, transparently and securely.
