The Nigeria Data Protection Commission (NDPC) has imposed a substantial fine of N766,242,500 (Seven-Hundred-and-Sixty-Six-Million-Two-Hundred-and-Forty-Two-Thousand-Five-Hundred naira) on MultiChoice Nigeria, the parent company of DStv and GOtv, for serious violations of the Nigeria Data Protection Act (NDP Act/NDPA). This penalty comes after a rigorous year-long investigation that commenced in the second quarter of 2024, triggered by widespread concerns regarding suspected breaches of privacy rights affecting MultiChoice subscribers and the illicit transfer of Nigerian citizens' personal data across borders.

According to Babatunde Bamigboye, NDPC's Head of Legal, Enforcement, and Regulations, the Commission's findings revealed that MultiChoice not only infringed upon the data privacy rights of its direct subscribers but also extended these violations to their friends, many of whom are not even MultiChoice subscribers. A critical discovery was MultiChoice's engagement in the illegal cross-border transfer of personal data belonging to Nigerian data subjects. The depth and nature of MultiChoice's data processing practices were characterized by the NDPC as "patently intrusive, unfair, unnecessary and disproportionate." This conduct, as stated by Bamigboye, represents a "grave affront to fundamental right to privacy as enshrined in section 37 of the 1999 Constitution of the Federal Republic of Nigeria."

The NDPC emphasized Nigeria's inherent right to safeguard its citizens and maintain data sovereignty under both international and existing municipal laws, highlighting the far-reaching implications of data protection for the rule of law, national security, and economic growth. In adherence to its standard remediation protocols, the Commission initially directed MultiChoice to implement appropriate corrective measures. However, the NDPC found these measures to be unsatisfactory. Consequently, due to MultiChoice's "want of cooperation," the significant fine of N766,242,500 was levied for the violations of the Nigeria Data Protection Act.

In light of these findings, Dr. Vincent Olatunji, the National Commissioner of the NDPC, has issued a directive for all channels and outlets through which MultiChoice collects the personal data of Nigerian citizens to be thoroughly investigated for non-compliance with the NDP Act. Dr. Olatunji underscored that any outlet found to be processing personal data in violation of the Act would be liable to penalties as prescribed by law. The NDPC itself operates as a public institution, serving as Nigeria's Data Protection Authority, and bases its data processing activities on recognized lawful grounds such as consent, legal obligation, and contractual agreements.