The Socio-Economic Rights and Accountability Project (SERAP) has called on President Bola Tinubu to direct the Nigeria Data Protection Commission (NDPC) to investigate suspected artificial intelligence-generated photographs and other irregularities in the preliminary Register of Voters released by the Independent National Electoral Commission (INEC).
The organisation wants the NDPC, led by its National Commissioner and Chief Executive Officer, Vincent Olatunji, to establish whether voters’ personal information was unlawfully accessed or altered and determine if the incidents violated the Nigeria Data Protection Act 2023.
SERAP made the demand in a letter dated October 31, 2026, and signed by its Deputy Director, Kolawole Oluwadare.
The call follows public concerns over questionable photographs and registration records discovered in INEC’s preliminary voters’ register, which was published online after a nationwide physical display exercise conducted from October 9 to 15.
“The reported irregularities raise serious concerns about the security and integrity of Nigerians’ personal data and the reliability of the voter register ahead of the 2027 general elections,” the organisation said.
SERAP added that “the security and accuracy of the voter register are fundamental to the protection of Nigerians’ personal data and their right to participate in public affairs.”
“Nigerians should not have to worry that their personal information could be altered, manipulated or accessed without proper safeguards,” it said.
The organisation argued that INEC’s acknowledgement of questionable entries and suspected AI-generated photographs made an independent investigation by the data protection regulator necessary.
“The public needs to know what happened, whether the law was breached and what measures are being taken to prevent a recurrence,” SERAP said.
It called for a forensic examination of the affected database and systems to determine whether personal information was accessed or modified unlawfully and whether the electoral commission complied with its obligations under the data protection law.
SERAP also wants the NDPC to establish whether the incidents amount to a personal data breach under Section 65 of the Act and whether INEC fulfilled its notification and record-keeping responsibilities.
The organisation said the investigation should identify the number of affected records, their geographical distribution, when and how the entries were created or altered, and those responsible.
It also raised concerns about the possible misuse of authorised login credentials by registration officers and potential failures in the safeguards meant to protect the accuracy and security of information in INEC’s database.
“An internal review by INEC cannot substitute for the NDPC’s independent exercise of its statutory data-protection mandate,” SERAP said.
The group warned that any compromise of the database could have consequences beyond data protection, given that the register contains the personal information of millions of Nigerians and determines who can participate in elections.
“Any unlawful alteration, manipulation or compromise of this information could undermine public confidence in the electoral process, compromise the accuracy and reliability of the voters’ register, and expose eligible voters to the risk of wrongful exclusion,” it said.
SERAP urged the commission to recommend stronger security measures and establish accessible procedures that would allow affected voters to check and correct their details without being unfairly disenfranchised.
It also called on the NDPC to make its findings and recommendations public, subject to lawful confidentiality requirements, and ensure that anyone found responsible is held accountable.
In a statement issued on October 27, INEC acknowledged concerns over “suspected AI-generated photographs appearing in the Preliminary Register of Voters” published on its website.
READ ALSO: Atiku To INEC: Identify, Prosecute Officials Behind Voter Register Irregularities
The commission explained that during the nationwide physical display of the register from October 9 to 15, “a number of questionable registration records were identified and flagged for further examination”.
It said it had begun reviewing the affected records and was taking “appropriate corrective action”.
INEC further acknowledged that the online publication “does not reflect all ongoing data-cleanup activities” and that it was “examining the circumstances surrounding the suspicious photographs, including possible technical or procedural lapses”.
The commission maintained that the published register was preliminary and not the final certified version. It said verification, adjudication and data-cleanup exercises would be completed before the final Register of Voters is certified on December 15, 2026.
To support its demand, SERAP cited provisions of the Nigeria Data Protection Act that empower the NDPC to investigate suspected violations, request relevant documents and information, and enforce compliance by data controllers and processors.
It specifically referenced Sections 24 and 39, which require personal data to be processed accurately and securely and protected against unlawful alteration, loss or unauthorised access.
The organisation also cited Section 40, which requires data controllers to notify the NDPC of a personal data breach likely to threaten individuals’ rights and freedoms within 72 hours of becoming aware of it.
SERAP further relied on Section 37 of the Nigerian Constitution, which guarantees the right to privacy, as well as provisions of the African Charter on Human and Peoples’ Rights and the International Covenant on Civil and Political Rights protecting citizens’ rights to participate in government and vote in genuine elections.
The organisation gave Tinubu seven days from the receipt or publication of its letter to ensure that the requested steps were taken.
“If we have not heard from you by then, SERAP shall consider appropriate legal actions and other lawful measures to compel your government, the NDPC, INEC and other relevant authorities to comply with our requests in the public interest,” it warned.
SERAP said the irregularities must be independently investigated and resolved before INEC certifies the final register, stressing that Nigerians must have confidence in the accuracy, reliability and security of the database ahead of the 2027 general elections.