The Nigeria Data Protection Commission (NDPC) has imposed a hefty fine of ₦766.24 million on MultiChoice Nigeria, the parent company of popular satellite TV services DStv and GOtv, for serious breaches of data privacy laws. The penalty follows an extensive investigation that began in the second quarter of 2024, focusing on MultiChoice's handling of subscribers' personal information and the illegal cross-border transfer of Nigerian citizens' data.
According to a statement released on Sunday, July 6, 2025, by Babatunde Bamigboye, NDPC’s Head of Legal, Enforcement and Regulations, the Commission found that MultiChoice violated the Nigeria Data Protection (NDP) Act by infringing on the privacy rights of both its subscribers and individuals connected to them who are not necessarily customers of the company. The investigation uncovered that the company’s data processing practices were not only intrusive but also unfair, unnecessary, and disproportionate.
"The depth of data processing by MultiChoice is patently intrusive, unfair, unnecessary and disproportionate," Bamigboye said. "This is a grave affront to the fundamental right to privacy as enshrined in section 37 of the 1999 Constitution of the Federal Republic of Nigeria." The Commission further revealed that MultiChoice engaged in the illegal transfer of personal data across borders, a violation that raises significant concerns about data sovereignty and national security.
Vincent Olatunji, NDPC’s National Commissioner, emphasized the gravity of the situation by ordering a comprehensive investigation into all outlets and platforms through which MultiChoice collects personal data from Nigerian citizens. "All outlets through which MultiChoice is collecting personal data of Nigerian citizens should be investigated for non-compliance," Olatunji stated. He warned that any entity processing personal data in violation of the NDP Act would be liable for penalties under the law.
The NDPC's probe was triggered by suspected breaches of subscribers' privacy rights and the unlawful cross-border transfer of data. During the investigation, the Commission demanded that MultiChoice implement remedial measures to address the violations. However, the company’s response was deemed unsatisfactory, prompting the imposition of the substantial fine due to a "want of cooperation," as noted by Bamigboye.
MultiChoice’s actions have broader implications beyond individual privacy concerns. The NDPC highlighted that protecting citizens' data sovereignty is vital not only for upholding the rule of law but also for safeguarding national security and fostering economic growth. The Commission underscored Nigeria's right to defend its citizens and maintain control over data under both international and domestic laws.
This case is not isolated in Nigeria’s regulatory landscape. Last year, the U.S.-based tech giant Meta faced combined fines exceeding $290 million from Nigerian authorities for various infractions, including data privacy violations and unauthorized advertising. These enforcement actions reflect Nigeria’s growing commitment to upholding data protection standards amid rapid digital expansion.
The NDPC, as Nigeria’s data protection authority, operates under recognized legal bases for data processing such as consent, legal obligation, and contract. Its role is to ensure that organizations comply with the Nigeria Data Protection Act and respect citizens' fundamental rights. The fine against MultiChoice sends a clear message to companies operating in Nigeria about the seriousness of data privacy compliance.
Experts and advocates see this enforcement as a critical step toward accountability and transparency in the digital age. Nurudeen Akewushola, an investigative reporter with The ICIR, remarked on the importance of such measures, emphasizing that courageous investigative reporting is key to social justice and good governance. His insights highlight the interconnectedness of regulatory enforcement, media scrutiny, and public awareness in driving systemic change.
As the NDPC continues to scrutinize MultiChoice’s data collection channels, the outcome of these investigations may set important precedents for how personal data is handled in Nigeria’s media and technology sectors. Subscribers and the wider public will be watching closely to see how the company adjusts its practices to align with legal requirements and restore trust.
Ultimately, this episode underscores the evolving challenges and responsibilities that come with managing personal data in an increasingly interconnected world. It raises pressing questions about how companies balance business interests with respect for privacy rights, and how regulators can effectively enforce laws to protect citizens without stifling innovation.
With the fine now public, MultiChoice faces pressure to demonstrate genuine compliance and cooperation with regulatory authorities. The NDPC’s robust stance serves as a reminder that data protection is not merely a technicality but a fundamental aspect of citizens’ rights and national integrity.
