The Nigeria Data Protection Commission has opened an investigation into Lotus Bank and the University of Lagos over allegations involving the use of students’ personal data to open bank accounts without proper consent.
The investigation follows complaints concerning the alleged collection and processing of students’ personal information in connection with bank account creation.According to the NDPC, the matter raises concerns about whether the students’ data was processed lawfully and in line with Nigeria’s data protection requirements.
The commission said it is examining the roles played by both Lotus Bank and UNILAG in the collection, sharing and processing of the affected students’ information.
The probe is expected to determine whether the institutions obtained the necessary consent and provided students with adequate information about how their personal data would be used.
The development has drawn attention to the growing importance of protecting students’ personal information as universities increasingly collaborate with financial institutions and other private organisations.Personal data such as names, identification details, phone numbers and other information can expose individuals to financial and privacy risks when processed without proper safeguards.
The NDPC's investigation therefore highlights the obligations of organisations that collect or process personal information, particularly when such data is used for financial services.
The commission has the authority to investigate alleged breaches of Nigeria's data protection laws and take appropriate regulatory action where violations are established.
However, the investigation does not by itself establish that Lotus Bank or UNILAG violated the law, as the allegations remain subject to regulatory findings.
The case could also have wider implications for how universities handle students’ personal information when partnering with banks and other service providers.
Students generally expect institutions holding their information to explain why it is being collected, who it may be shared with and how it will be used.
The investigation could provide further clarity on whether the students involved were properly informed about the account-opening process and whether the required legal basis for processing their information existed.
It also reinforces the importance of transparency and accountability when organisations process personal data for commercial or financial purposes.
As the NDPC proceeds with its probe, affected students and other stakeholders will likely await the commission's findings and any recommendations or enforcement measures that may follow.The outcome could influence how similar university-bank partnerships are structured in the future and strengthen expectations around consent, disclosure and data security.