Izini
Everything Izini does →The penalty limits
Section 48 of the Nigeria Data Protection Act 2023 lets the NDPC impose a penalty or remedial fee. The limit depends on whether you are a data controller or processor of major importance:
- Of major importance: up to ₦10 million or 2% of the previous year's annual gross revenue, whichever is greater.
- Everyone else: up to ₦2 million or 2% of the previous year's annual gross revenue, whichever is greater.
These are maximums. Fidelity Bank's ₦555.8 million fine was reported as about 0.1% of its 2023 gross revenue.
Cases on record
| Organisation | Fine | When | What the NDPC found |
|---|---|---|---|
| MultiChoice Nigeria | ₦766M | July 2025 | Violations of subscribers' privacy rights, including people who were not subscribers, and unlawful transfer of personal data out of Nigeria. |
| Fidelity Bank | ₦555.8M | August 2024 | Personal data collected without a proper legal basis, processing without informed consent (including through cookies and banking apps), and non-compliant third-party processors. |
| Meta | $32.8M | February 2025 | Behavioural advertising on Facebook and Instagram, cross-border transfers, processing non-users' data and a missing audit filing. Meta challenged it; the Federal High Court entered the parties' settlement in late 2025, on terms not made public. |
By early 2026 the NDPC had collected more than ₦7.2 billion in registration fees, compliance revenue and fines combined. The report says registrations make up most of it.
Meta: two regulators
Meta was also fined $220 million by the Federal Competition and Consumer Protection Commission (FCCPC) in July 2024, after an investigation run jointly with the NDPC. That fine was imposed under consumer protection law, not the NDPA. The Competition and Consumer Protection Tribunal upheld it in April 2025.
What the cases have in common
- Consent you cannot prove. Fidelity Bank processed data without informed consent. Under section 26 the burden of proving consent is on you.
- Suppliers you did not check. Fidelity Bank relied on non-compliant processors. Section 29 makes you answerable for them.
- Data sent abroad without a basis. MultiChoice and Meta were both cited for cross-border transfers, which sections 41 to 43 regulate.
- Filings not made. The NDPC cited Meta for not filing its compliance audit.
Each of these is an area Izini covers: consent records, supplier checks and transfer assessments, and the annual audit return.
Sources
- NDPC, Frequently asked questions (NDPA section 48)
- ICIR, NDPC fines MultiChoice Nigeria ₦766 million (6 July 2025)
- TechAfrica News, Fidelity Bank fined ₦555.8 million by NDPC (22 August 2024)
- BusinessDay, Meta and NDPC resolve $32.8m privacy dispute out of court
- Connecting Africa, Nigerian watchdog fines Meta $220M (July 2024)
- Techpoint Africa, tribunal upholds the $220m fine (April 2025)
- Techmoonshot, Nigeria collected ₦7.2 billion (10 February 2026)