PRESS STATEMENT - 4TH JUNE 2026, ABUJA, NIGERIA
The recent disclosure of personal voter data allegedly obtained from the Independent National Electoral Commission (INEC) has raised significant concerns about the security of voters' personal information and compliance with Nigeria's data protection laws.
The right to privacy is guaranteed under Section 37 of the Constitution of the Federal Republic of Nigeria 1999, which protects the privacy of citizens, their homes, correspondence, telephone conversations, and communications. Any unauthorised access to or disclosure of personal information may constitute a violation of this fundamental right. In addition, the Nigerian Data Protection Act (NDPA) 2023 imposes clear obligations on institutions that collect and process personal data. The Act requires that personal data be processed lawfully, fairly, and transparently, and that adequate technical and organisational measures be implemented to protect such data against unauthorised access, loss, destruction, or disclosure.
INEC has stated that the breach occurred through the credentials of one of its personnel and has commenced an internal investigation. The Commission has also indicated that the Department of State Services (DSS) is conducting a separate investigation into the incident. According to INEC, there have been no additional breaches beyond the one voter's information already disclosed.
While these investigations are important, INEC must ensure that it takes adequate steps to protect the personal information of voters, as well as the integrity of the voter register. The voter register is the first step towards conducting credible elections. Voters must trust its sanctity as well as the protection the law affords their personal data. INEC must also ensure that the staff under whom such a breach occurred face appropriate disciplinary actions.
Beyond legal compliance, this incident highlights the urgent need for stronger cybersecurity safeguards and data governance practices within public institutions. Citizens entrust agencies with highly sensitive personal information, and that trust must be matched by robust measures to secure such data and prevent unauthorised access.
We therefore call on INEC to provide timely updates on the outcome of its investigations, clarify whether the Nigerian Data Protection Commission has been notified in accordance with the law, and disclose the measures being taken to prevent future breaches. Transparency and accountability in responding to this incident are essential to maintaining public confidence in the Commission and in the integrity of Nigeria's electoral and data protection systems.
As Nigeria continues to digitise public services and electoral processes, the protection of personal data must remain a priority. Data security is a constitutional, legal, and democratic imperative.
About CJID
The Centre for Journalism Innovation and Development (CJID) is a non-profit organisation advancing democratic accountability, media freedom, and civic participation in Africa. Through its Media in National Elections (MiNE) project, CJID supports media-led electoral integrity initiatives across Nigeria, Ghana, Guinea, Liberia, Sierra Leone, The Gambia, Senegal, and Côte d'Ivoire. Its interventions combine fact-checking, research, civic education, and observation to strengthen electoral credibility and citizen engagement. CJID remains committed to promoting informed participation, countering disinformation, and empowering citizens to defend democracy through knowledge, truth, and transparency.
Signed
Akintunde Babatunde
Executive Director, CJID
