The Nigeria Data Protection Commission (NDPC) has initiated an immediate investigation into the popular Chinese e-commerce platform Temu for suspected breaches of the Nigeria Data Protection Act (NDPA) 2023.

Announced on Monday, February 16, 2026, the probe was ordered by NDPC National Commissioner and CEO, Dr. Vincent Olatunji, following concerns raised about the platform’s data handling practices. Key issues under scrutiny include online surveillance through personal data processing, accountability, adherence to data minimisation principles, transparency in privacy policies, duty of care toward users, and compliance with rules on cross-border data transfers.

Preliminary findings by the Commission reveal that Temu processes the personal information of approximately 12.7 million data subjects in Nigeria, contributing to its global base of around 70 million daily active users. The investigation stems from complaints and observations suggesting that Temu’s operations may not fully align with Nigerian data protection requirements.

In a statement released by Babatunde Bamigboye, Head of Legal, Enforcement & Regulations at the NDPC, the Commission emphasized that third-party data processors acting for controllers (like Temu) must verify compliance with the NDPA, or risk liability under the law.

This development highlights growing regulatory scrutiny of foreign tech and e-commerce giants operating in Nigeria, as the country strengthens enforcement of its data privacy framework to protect citizens’ personal information in an increasingly digital economy. The NDPC has not yet indicated a timeline for concluding the probe, but outcomes could include fines, operational directives, or other enforcement actions if violations are confirmed.

The story continues to unfold, with stakeholders watching closely for implications on user privacy and international business compliance in Nigeria.