NDPC Probes Temu Over Alleged Data Breach

The Nigeria Data Protection Commission (NDPC) has ordered an immediate investigation into the data processing operations of global e-commerce platform Temu, amid concerns that the company may be violating provisions of the Nigeria Data Protection Act (NDP Act), 2023.

According to the official statement signed by Babatunde Bamigboye, Esq., CDPRP, Head of Legal, Enforcement & Regulations at the NDPC, Dr. Vincent Olatunji, National Commissioner/CEO, directed the probe following mounting concerns about Temu’s data handling practices that may infringe data protection laws.

The investigation was triggered by issues relating to online surveillance through personal data processing, accountability, data minimisation requirements, transparency, duty of care, and cross-border data transfer, the Commission noted.

“Preliminary investigations indicate that Temu is an e-commerce platform which processes personal information of approximately 12.7 million data subjects in Nigeria with 70 million daily active users globally,” the NDPC statement said, as extracted from the press release.

The Commission further warned that processors who engage in processing activities on behalf of data controllers without verifying their compliance with the NDP Act may be liable under the NDP Act.

The move underscores Nigeria’s tightening enforcement of data privacy laws as regulators scrutinise digital platforms handling large volumes of personal data. Analysts say the outcome of this probe could set important precedents for data protection compliance among global companies operating in Nigeria’s digital economy.