Nigeria’s data protection regulator has initiated a formal investigation into the operations of the e-commerce platform Temu on potential violations of national data privacy standards. The National Data Protection Commission (NDPC) ordered the probe amid indications that Temu processes personal data belonging to about 12.7 million Nigerians, raising compliance concerns under the Nigeria Data Protection Act.
The directive was issued by Dr. Vincent Olatunji, the NDPC’s National Commissioner and Chief Executive Officer, following a regulatory review that flagged multiple areas of non-conformance in Temu’s data handling practices. The Commission’s concerns centre on whether the platform’s collection, processing and potential transfer of personal information meet key statutory requirements for online surveillance control, transparency, accountability, data minimisation, and duty of care.
According to the statement released by the NDPC, preliminary investigations suggest that Temu’s systems handle extensive personal information for millions of users in Nigeria alongside tens of millions of global daily active users. The scale of data processing, and the manner in which it is conducted, are said to raise significant questions about compliance with Nigeria’s privacy law.
Beyond raw volumes, the NDPC is scrutinising whether Temu provides sufficient transparency to Nigerian data subjects about its data practices. Legal obligations under the Nigeria Data Protection Act demand clear communication on what data is collected, why it is collected, how long it is retained, and under what conditions it is shared, particularly if transferred across borders.
In its release, the Commission also cited concerns that may extend to data minimisation principles, whether Temu’s systems collect only the data necessary for specific e-commerce functions and online surveillance activities that could exceed the scope necessary for legitimate commercial operations. These factors form part of the NDPC’s evaluation framework for data controllers and processors operating within the Nigerian digital ecosystem.
The investigation reflects heightened regulatory vigilance following recent enforcement efforts under the Nigeria Data Protection Act. In previous cases, the NDPC has imposed significant sanctions on firms for breaches of privacy standards and has consistently called for strict adherence to data governance principles across sectors.
Dr. Olatunji underscored that companies must verify legal compliance when processing personal data on behalf of others, warning that failure to do so could result in enforcement actions or penalties. The Commission’s position is clear: data controllers and processors must operate within the legal framework or face consequences under Nigerian law.
Temu has not publicly responded to the NDPC’s directive at the time of reporting. The platform now faces a detailed regulatory review that could determine whether its operations in Nigeria align with statutory data protection obligations. The outcome may have broader implications for how global digital platforms process and safeguard personal data within Nigerian jurisdiction.
The NDPC’s action serves as a reminder to all digital service providers that data privacy compliance is mandatory and enforceable, not optional. Firms handling extensive volumes of personal data must uphold the principles enshrined in the Nigeria Data Protection Act or risk formal sanctions.
