NDPC Investigates Temu for Possible Data Protection Violations

In a significant move for data protection enforcement, Nigeria’s data regulator — the Nigeria Data Protection Commission (NDPC) — has opened a formal investigation into Chinese‑owned e‑commerce platform Temu over potential violations of the Nigeria Data Protection Act (NDPA). The probe centers on the platform’s handling of personal data, including online surveillance, transparency, data minimisation, and cross‑border transfers.

This development places Nigeria among the growing list of jurisdictions scrutinising Temu’s data practices and reinforces the importance of robust privacy governance as digital commerce expands rapidly.

What Triggered the Investigation?

The NDPC’s investigation was ordered by its Chief Executive Officer, Vincent Olatunji, after preliminary findings suggested that Temu might be violating core principles of Nigeria’s data protection regime, such as:

• Online surveillance and tracking of users
• Lack of transparency in data collection
• Possible failure to limit data to what is necessary
• Cross‑border transfer of personal data without adequate safeguards

These concerns align with obligations set out in the Nigeria Data Protection Act, 2023, which requires organisations to ensure personal data is processed lawfully, transparently, and with respect for the rights of data subjects.

According to the regulator, Temu processes personal data for approximately 12.7 million Nigerian users, with around 70 million daily active users globally — underscoring the scale of potential data protection implications.

Why the Probe Matters for Nigerians and Digital Consumers

This investigation is especially significant for several reasons:

1. Data Sovereignty and Local Regulation

Nigeria’s NDPC is asserting its authority under the NDPA to demand compliance from digital platforms operating within its jurisdiction. This upholds data sovereignty — the principle that personal data of Nigerian citizens must be governed by local law rather than foreign systems alone.

In the past, the Commission fined Multichoice Nigeria ₦766 million for breaches of data protection rules, including unlawful cross‑border transfers, demonstrating that enforcement has real consequences.

2. Transparency and Accountability

Consumers increasingly demand clear information about how their data is used. When an international platform like Temu operates at scale without clear transparency, regulators step in to protect privacy rights.

3. Precedent for Digital Market Oversight

Global regulators have begun scrutinising Temu in other jurisdictions too. For example, the Personal Information Protection Commission (PIPC) of South Korea previously sanctioned Temu for unlawful cross‑border data transfers and other violations, reflecting a broader pattern of regulatory concern.

What the NDPC Is Focusing On

The NDPC’s probe is looking into specific areas where Temu may be non‑compliant:

Focus Area	What It Means	Why It Matters
Online Surveillance	Monitoring user behaviour beyond what is necessary	Threatens user privacy and may be unlawful
Transparency	Clear communication of data practices	Users must know what is collected and why
Data Minimisation	Restricting collection to only necessary data	Reduces risk of misuse or breach
Cross‑border Transfers	Moving data outside Nigeria without adequate protection	Raises concerns over data security and foreign access

Temu’s Response and Cooperation

So far, Temu has emphasised that it is committed to complying with applicable laws and has expressed willingness to cooperate with the NDPC during the ongoing investigation. However, precise details about how the company plans to address the regulator’s concerns have not been publicly disclosed.

This cooperation reflects a pragmatic approach many global platforms take when engaging with privacy regulators — balancing compliance with operational needs.

Broader Implications for Digital Platforms

Nigeria’s move to probe Temu is part of wider trends in data protection enforcement:

• Regulators globally are increasingly holding tech and e‑commerce companies accountable under local privacy laws.
• Cross‑border data transfers are a focal point for multiple data protection authorities due to concerns over jurisdictional controls and access.
• Platforms that command large user bases are now expected to go beyond minimal compliance to adopt privacy‑by‑design principles.

For organisations seeking to understand data protection best practices, the International Association of Privacy Professionals (IAPP) provides an authoritative resource on emerging privacy trends and regulatory expectations.

What This Means for Nigerian Consumers

If you are a Nigerian user of Temu or similar digital platforms:

• Be aware that your personal information may be subject to more rigorous scrutiny and protection under Nigerian law.
• Monitor updates from the NDPC, which will likely publish outcomes once the investigation concludes.
• Understand that data protection laws are designed to protect your rights, including consent, transparency, and control over how your data is used.

Frequently Asked Questions

What is the Nigeria Data Protection Commission (NDPC)?

The NDPC is Nigeria’s regulatory authority responsible for enforcing the Nigeria Data Protection Act, ensuring organisations comply with data privacy laws.

Does the investigation mean Temu has already broken the law?

Not necessarily. An investigation is a formal assessment to determine whether violations have occurred. If breaches are confirmed, the NDPC may take enforcement actions.

What laws govern this investigation?

The probe is conducted under the Nigeria Data Protection Act (NDPA), 2023, which sets standards for lawful collection, processing, storage, and transfer of personal data.

Could Temu face fines or sanctions?

Yes. If the NDPC finds Temu non‑compliant, penalties could include fines, restrictions on data activities, or other enforcement measures under the NDPA.

How long will the investigation take?

The NDPC has not specified a timeline. Complex data investigations involving international platforms can take several weeks to months.

Conclusion

Nigeria’s investigation into Temu’s data handling practices marks a pivotal moment in data protection enforcement in Africa. This case highlights the increasing expectations placed on global digital platforms to respect local data protection laws, uphold transparency, and safeguard user privacy.

For consumers, this is a reminder of the evolving digital rights landscape. For businesses, it signals that robust data governance isn’t optional — it’s central to legal compliance and trust in the digital economy.

Staying informed and proactive about data protection obligations will be key as regulators like the NDPC continue to reinforce privacy standards in a fast‑digitising world.