By Obinna Uballa
Temu, a Chinese e-commerce company, is facing regulatory pressure in Nigeria as the Nigeria Data Protection Commission (NDPC) launches a formal investigation into alleged privacy violations affecting an estimated 12.7 million Nigerians, a probe that could expose the fast-growing platform to significant financial penalties.
Punch Newspaper reported, quoting sources familiar with the matter, that the commission began scrutinising the Chinese-owned marketplace last week over concerns about how it collects, processes and transfers users’ personal data. Preliminary findings indicate that Temu processes data belonging to approximately 12.7 million Nigerian users, while boasting about 70 million daily active users globally.
Under the Nigeria Data Protection Act (NDPA), organisations found in breach of data protection rules may face penalties of up to two per cent of their annual gross revenue in the preceding year or N10m, whichever is higher. For a global platform of Temu’s scale, such a sanction could translate into substantial financial exposure.
Regulators are reportedly examining issues including transparency, accountability, online surveillance practices, data minimisation, duty of care, and cross-border data transfers. The case underscores broader global debates over how foreign technology firms handle personal data in emerging markets where millions increasingly rely on digital platforms for shopping and financial transactions.
However, NDPC officials suggest that enforcement may prioritise corrective compliance over immediate punishment.
“A lot of things could apply. We could take them through a remedial process if they cooperate with us. That means guiding them to do the right thing,” one official said on condition of anonymity.
According to sources, organisations that cooperate fully and rectify identified breaches may only be required to pay a remedial fee instead of facing heavier fines. Another senior official stressed that the investigation remains ongoing and no final decision has been reached.
The NDPC has yet to release a formal public statement specifically detailing the Temu probe. But the commission has previously demonstrated its enforcement strength. In February 2025, it fined Meta, parent company of Facebook, $32.8m for data protection violations, while reporting over N5.2bn in compliance revenue from 246 investigations.
Temu, owned by PDD Holdings, entered the Nigerian market in November 2024 and rapidly gained traction through aggressive advertising, steep discounts and a mobile-first shopping model. Within months, it became one of the country’s most downloaded shopping apps.
Despite its popularity, Temu operates in Nigeria without a registered local corporate entity, functioning as a foreign digital platform without a subsidiary. Analysts say this extraterritorial structure complicates oversight, particularly around consumer protection and data governance.
Responding to enquiries, Temu confirmed it has received the NDPC’s inquiry and is cooperating with regulators.
“Protecting user privacy and data security is Temu’s top priority. We are fully committed to Nigerian laws and will maintain open dialogue with the NDPC to resolve all concerns,” the company said in an email.
Legal practitioner and Executive Director of Adaba Consult, Ejike Onyeaso, described the regulation of electronic commerce platforms as a necessary step in strengthening Nigeria’s digital economy.
“The regulation of electronic commerce platforms, especially regarding how they handle customer data, is an important development,” he said, while cautioning that enforcement powers must be clearly defined to safeguard citizens’ privacy rights.
Temu has previously faced regulatory sanctions abroad. In South Korea, it was fined $978,000 in May 2025 for undisclosed cross-border data transfers and failure to appoint a local representative. In the United States, it paid a $2m civil penalty in September 2025 to resolve allegations related to inadequate seller verification.
The ongoing Nigerian probe may set a precedent for how authorities regulate foreign digital platforms that process vast amounts of citizens’ personal data without establishing a local presence.
