NDPC Probes UNILAG, Lotus Bank, Hackerbella Over Students’ Data

By Adebola Muili

The Nigeria Data Protection Commission (NDPC) has commenced a forensic investigation into the University of Lagos (UNILAG), Lotus Bank and Hackerbella Ltd over alleged unlawful use of students’ personal data to open bank accounts.

The investigation followed public complaints alleging that students’ personal information was collected, processed and used to facilitate the opening of bank accounts without a lawful basis or adequate transparency.

The Commission disclosed this in a statement on Tuesday, August 11, 2026, signed by its Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, on behalf of the NDPC.

According to the Commission, its National Commissioner and Chief Executive Officer, Dr Vincent Olatunji, directed the investigation team to conduct a comprehensive forensic assessment of the circumstances surrounding the collection, processing, use and disclosure of the affected students’ personal data.

The investigation will also establish the respective roles and responsibilities of UNILAG, Lotus Bank and Hackerbella Ltd in the alleged data-processing activities.

The NDPC said it would assess the compliance of the three organisations with the Nigeria Data Protection Act, 2023, while examining the potential risks posed to the rights and freedoms of the affected students.

It said the investigation would determine whether appropriate Data Protection Impact Assessments (DPIAs) were conducted and whether any credit-scoring or profiling activities involving the students were carried out lawfully and transparently.

The Commission will also examine the use of automated decision-making systems, the adequacy of privacy notices issued to the students and the arrangements for sharing their personal information.

Other areas to be scrutinised include the lawful basis for processing the students’ data, data-minimisation practices, purpose limitation, data-retention policies and the technical and organisational measures adopted to safeguard the rights of the affected individuals.

The NDPC said the forensic investigation would help determine whether the collection, processing and sharing of the students’ personal information complied with the provisions of the Nigeria Data Protection Act and whether any of the parties breached their obligations to the affected data subjects.

However, the commencement of the investigation does not constitute a finding of wrongdoing against UNILAG, Lotus Bank or Hackerbella Ltd.

The Commission is yet to announce any final determination or sanctions, as its findings will be based on evidence obtained during the forensic investigation.