Fintechs, others at risk of data protection breach in 2026 – Expert

As data protection compliance becomes nonnegotiable with enforcement for breaches, indications are that focus will be on high-risk industries like fintech, healthcare to mention just a few.

Making this submission at the weekend was Ademikun Adeseyoju, Head of Emerging Services at DataPro, foremost credit rating agencies.

From available information, breaches can result in severe penalties imposed by the Nigeria Data Protection Commission (NDPC). For major data controllers/processors, fines can reach up to ₦10 million or 2% of annual gross revenue, whichever is higher, along with potential imprisonment. Smaller organisations face fines up to ₦2 million or 2% of annual revenue.

Lending credence to the foregoing, Adeseyoju, in a statement announcing the commencement of its 2026 Privacy Week, themed: “Privacy in the Age of Emerging Technologies: Trust, Ethics, and Innovation”, anticipates intensity on Sector-Specific Enforcement, with the NDPC focusing on high-risk industries like Fintech, Healthcare, etc.

Pressed further, he said, the week-long observance serves as an inflection point for analysing the tectonic shifts in Nigeria’s 2025 data protection landscape while preparing organisations for the rigorous demands of the coming year.

In its review of the outgoing year, it recalled that 2025 marked Nigeria’s definitive transition from the Nigeria Data Protection Regulation (NDPR) to the full statutory power of the Nigeria Data Protection Act (NDPA) and the General Application and Implementation Directive (GAID) 2025. This shift signalled a move from guidelines-based compliance to a mandatory, enforcement-driven regime.

Specifically, it noted that key milestones from the 2025 ecosystem includes active regulatory posture with the NDPC moving decisively into active enforcement, publicly naming non-compliant entities, particularly in the financial services sector.

Besides, it cited judicial precedents as landmark court rulings in 2025 affirmed that transparency in personal data handling is a constitutionally protected right.

Courts awarded significant damages to data subjects for privacy breaches, signalling that organisational size no longer shields against accountability.

Furthermore, regulatory settlements with multinational technology firms have set a high bar for behavioural advertising and data processing standards in Nigeria.

This is just as the Cybersecurity Landscape in 2025 witnessed an unprecedented surge in cyber threats as attackers shifted their focus from technical exploits to identity-driven campaigns, targeting valid credentials with high precision.

This “identity-centric” threat environment has made robust access management a non-negotiable requirement for corporate resilience.

In its 2026 outlook, DataPro projected that 2026 will be defined by Board and Executive Ownership. Privacy will no longer be an IT-only concern but a standing governance issue requiring regular risk reports and dedicated budgets.

Advertisement

“We also anticipate a surge in individual claims and constitutional privacy actions, meaning organisations must remain “litigation ready” by preserving processing records and strengthening internal controls. As a licensed Data Protection Compliance Organisation (DPCO), DataPro Limited is positioned to help your organisation achieve and sustain its compliance objectives for 2026. With over 30 years of regulatory and compliance experience, partnering with DataPro ensures access to deep expertise, practical implementation support, and a collaborative approach to meeting your NDPA compliance goals.”