The Joint Admissions and Matriculation Board (JAMB) has issued a stern warning to all Computer-Based Test (CBT) centres in Nigeria, prohibiting them from copying or retaining the personal data of candidates who registered or sat for the Unified Tertiary Matriculation Examination (UTME).
This directive, which was made public through an official statement, is aimed at ensuring compliance with Nigeria’s data protection regulations.
“In order to avoid prosecution for violating the provisions set forth by the Nigeria Data Protection Commission (NDPC), all Computer-Based Test (CBT) centres and their operators are advised against copying or retaining the data of candidates who registered for the Unified Tertiary Matriculation Examination (UTME) or those who sat for examinations at their centres.
“Possessing candidates’ data without authorisation constitutes a breach of data protection laws. Any centre found in possession of such data will be subject to legal action, as ignorance of the law is no defence,” JAMB stated.
The examination body explained that the announcement serves as a final notice to all CBT centres, reminding them of their obligations under Nigerian data protection laws and warning against any form of data misuse.
Nigeria Data Protection Act
NDPC unveiled the Nigeria Data Protection Act – General Application and Implementation Directive (NDP Act-GAID), which provides comprehensive guidelines to help data controllers and processors comply with the law. The full implementation of this directive is set to commence in September 2025, with a six-month transition period for organizations.
The directive, which will be made available on the NDPC portal, covers critical areas such as data protection principles, lawful bases for data processing, data subjects’ rights, cross-border data transfers, compliance audit returns, and standardised grievance redress mechanisms.
Additionally, the NDPC introduced the Standard Notice to Address Grievance (SNAG), a mechanism that allows individuals to demand remedial action directly from data controllers and processors without first going through the commission.
The National Commissioner and Chief Executive Officer of the NDPC, Dr. Vincent Olatunji, noted that this would empower over 230 million Nigerians to play an active role in enforcing data protection laws.
What you should know
Nigeria has been strengthening its data protection framework through the NDPC, especially in sectors that handle large volumes of sensitive personal data, such as education.
The NDPC conducted over 1,000 investigations across various sectors, including finance and digital lending platforms. As of June 2024, the Commission had collected over N400 million in sanctions from seven companies for various data breaches.
To boost Nigeria’s data protection capacity, the NDPC signed a Memorandum of Understanding with Mastercard in May 2025 to strengthen the country’s data protection framework and upskill professionals in the sector.
