The Nigeria Data Protection Commission (NDPC) has launched an investigation into Chinese-owned e‑commerce platform Temu over alleged violations of the Nigeria Data Protection Act (NDPA) 2023, citing concerns about extensive online surveillance and questionable handling of Nigerians’ personal data.
NDPC orders immediate probe
In a press release dated 16 February 2025, the NDPC National Commissioner and Chief Executive Officer, Dr Vincent Olatunji, ordered an immediate investigation into Temu’s data processing activities, warning that the platform’s operations “may be in violation” of the NDPA. The regulator said the move followed growing worries about how Temu collects, uses and transfers personal information of Nigerian users.
Concerns over surveillance and data practices
According to the statement, the probe was triggered by concerns around online surveillance through personal data processing, accountability gaps, and possible breaches of data minimisation and transparency requirements under the law. The Commission also flagged issues related to duty of care and cross‑border data transfers, suggesting Temu’s data flows out of Nigeria will come under particular scrutiny.
Scale of data involved
Preliminary NDPC findings describe Temu as an e‑commerce platform that processes personal information of approximately 12.7 million data subjects in Nigeria. The release further notes that the platform records about 70 million daily active users globally, underscoring the potential impact of any compliance failure on both Nigerian and international users.
Warning to data processors
The National Commissioner used the Temu case to issue a broader warning to companies that process data on behalf of others. He cautioned that processors who carry out data processing activities for data controllers without first verifying their compliance with the NDPA may themselves be held liable under the Act.
Signed enforcement notice
The press release was signed by Babatunde Bamigboye, Head of Legal, Enforcement and Regulations at the NDPC, signalling that any findings from the investigation could lead to regulatory sanctions or enforcement actions against Temu and non‑compliant processors.
