NDPC fines MultiChoice ₦766m for data privacy violations

Summary

• Nigeria’s data protection agency imposes largest-ever fine of ₦766 million on MultiChoice for breaching data privacy laws
• Violations include unauthorised data processing and illegal cross-border transfers, affecting both subscribers and non-customers
• Regulatory scrutiny intensifies amid rising concerns over privacy, consumer rights, and corporate compliance in Nigeria

The Nigeria Data Protection Commission (NDPC) has imposed a fine of ₦766,242,500 (approximately $501,340) on MultiChoice Nigeria, the parent company of pay-TV providers DStv and GOtv, for multiple breaches of the Nigeria Data Protection Act (NDPA). The fine, announced on 6 July 2025, follows a year-long investigation into the company’s data handling practices and marks the largest penalty issued by the commission since the Act’s enactment in 2023.

The investigation, initiated in the second quarter of 2024, was triggered by allegations of unauthorised processing of subscribers’ personal data and unlawful cross-border data transfers. MultiChoice was found to have collected and processed the personal information of subscribers, and in some cases, individuals with no direct relationship to the company, without valid consent or a lawful basis, in clear contravention of the NDPA.

The NDPC described the company’s practices as “intrusive, unfair, unnecessary, and disproportionate,” noting that they violated Section 37 of the 1999 Constitution of Nigeria, which guarantees the fundamental right to privacy. According to Babatunde Bamigboye, Head of Legal, Enforcement and Regulations at the NDPC, MultiChoice failed to comply with remediation directives and showed inadequate cooperation throughout the investigation.

Beyond the unauthorised data processing, MultiChoice was also accused of transferring personal data beyond Nigeria’s borders without meeting the required legal safeguards, a serious breach that undermines the country’s data sovereignty and has implications for national security and economic stability.

In response, the NDPC’s National Commissioner, Dr Vincent Olatunji, ordered a full compliance audit of all MultiChoice platforms and outlets involved in data collection. Any outlet found to violate the NDPA may face additional sanctions.

The commission stressed that its preference is for companies to adopt a remediation-based approach, correcting breaches before punitive measures are imposed. However, in this case, MultiChoice’s failure to cooperate and adequately address the violations left the NDPC with no option but to levy the fine.

This latest sanction compounds MultiChoice Nigeria’s regulatory troubles. Earlier in 2025, the Federal Competition and Consumer Protection Commission (FCCPC) directed the company to suspend a planned increase in subscription rates for DStv and GOtv. MultiChoice proceeded with the hike on 1 March, prompting criminal charges against the firm and its CEO, John Ugbe, for obstruction, defiance of regulatory orders, and dissemination of misleading information.

The NDPC’s action is part of a broader trend towards the rigorous enforcement of data protection laws in Nigeria, in line with global best practices. The commission has previously sanctioned international tech firms, including a $290 million fine against Meta in 2024 for similar infractions.

The MultiChoice case has significant implications for the handling of personal data in Nigeria’s media and entertainment sectors. With subscriber data becoming an increasingly valuable asset, the fine sends a strong message to corporations on the importance of data governance and legal compliance.

Despite multiple requests, MultiChoice has yet to issue a public statement regarding the NDPC’s decision. The commission has reaffirmed its commitment to upholding consumer rights and protecting Nigeria’s digital ecosystem through consistent enforcement of data protection laws.