Nigeria's National Data Protection Commission is actively investigating Temu for the alleged misuse of data belonging to 12.7 million Nigerians Source: TechNext.ng. That investigation is proceeding while the Federal Government has ordered the NDPC, along with the National Communications Commission and the National Information Technology Development Agency, to suspend enforcement of new internet platform rules pending the development of a unified regulatory framework Source: PRNigeria News. Read those two sentences together, and the structural contradiction at the centre of Nigeria's digital governance moment becomes visible: enforcement is suspended, except when it isn't.
This is not a procedural inconsistency. It is the defining asymmetry of Nigeria's regulatory transition period — and it lands hardest on Nigerian founders, not on Temu.
Who can afford legal limbo
Temu operates in Nigeria with the legal infrastructure of a well-capitalised global platform. Its parent company Pinduoduo has navigated regulatory scrutiny across multiple jurisdictions — from the United States to the European Union — and maintains the compliance personnel to absorb ambiguity as a cost of doing business. An investigation by the NDPC, even one conducted while platform rules are technically suspended, is a friction Temu can manage. Its Nigerian counterparts — the Flutterwaves, Paystack alumni building the next payments layer, the logistics startups in Yaba and Surulere operating on thin margins — cannot absorb the same uncertainty. They lack the in-house legal teams to parse which rules remain operative, which are suspended, and under what conditions enforcement might resume or escalate.
The three-regulator suspension was necessary. The NCC, NITDA, and NDPC had been issuing conflicting guidance to platforms operating in Nigeria, creating a compliance tangle that made coherent product development difficult Source: ITWeb Africa. A unified framework is the right destination. But the transition window — undefined in length, unclear in scope — is producing a condition where selective enforcement becomes structurally possible even if it is not deliberately designed.
The enforcement question no one is answering
The critical question regulators have not publicly addressed is whether the NDPC's Temu investigation draws on rules now suspended or on pre-existing data protection obligations under Nigeria's 2023 Data Protection Act, which predates the enforcement pause. If the former, Nigeria's regulatory credibility is genuinely at risk — and foreign platforms' legal teams will argue exactly that in any proceedings. If the latter, the NDPC is on firmer ground, but the optics of pursuing a Chinese e-commerce giant while telling Nigerian platforms the rulebook is being rewritten still demands explicit communication from the Commission.
This matters beyond Lagos. Kenya, Ghana, and Rwanda are each building their own data governance architectures, and Nigerian regulatory practice — given the country's market size — functions as a de facto reference point for the continent. If Nigeria's transition period is perceived as producing ad-hoc enforcement, it gives foreign platforms operating across West Africa a litigation template: challenge enforcement actions on procedural grounds during any regulatory transition. That is a precedent no African regulator wants to set.
What the unified framework must deliver
Nigeria's forthcoming consolidated framework — emerging from the NCC, NITDA, and NDPC coordination exercise — must do more than reconcile three agencies' jurisdictions. It must establish explicit transition rules: which obligations remain in force during any consolidation period, what the enforcement threshold is for continuing investigations, and how compliance timelines will be communicated to domestic versus foreign operators.
AEW 2026's planned focus on Nigeria's AI infrastructure signals that Abuja recognises the stakes of getting digital governance right at this moment. But regulatory credibility is not built at conferences — it is built through predictable, consistently applied rules. Nigerian startups building for the continent's largest consumer market deserve a compliance environment where the rules are visible, stable, and equally applied. Right now, they have none of those things. Temu, by contrast, has lawyers.