The Socio-Economic Rights and Accountability Project (SERAP) has asked President Bola Tinubu to order the Nigeria Data Protection Commission (NDPC) to carry out an independent investigation into suspected AI-generated photographs and other questionable records found in the Independent National Electoral Commission’s (INEC) preliminary Register of Voters, and has warned of legal action if he fails to act within seven days.
In a letter dated 31 October 2026 and signed by its deputy director, Kolawole Oluwadare, the organisation said the reported irregularities raise “serious concerns about the security and integrity of Nigerians’ personal data and the reliability of the voter register ahead of the 2027 general elections.”
SERAP wants Tinubu to direct Dr Vincent Olatunji, the NDPC’s National Commissioner and Chief Executive Officer, to investigate promptly, thoroughly and independently.
The group said the probe should establish the nature and extent of the irregularities, determine whether a personal data breach occurred under the Nigeria Data Protection Act 2023, identify those responsible, and ensure that affected Nigerians can verify and correct their records without being unfairly excluded from the electoral process.
The letter follows INEC’s publication of the preliminary register and its later acknowledgement of suspected AI-generated photographs and questionable registration records. According to INEC’s statement of 27 October 2026, these were identified during the nationwide physical display of the register from 9 to 15 October 2026.
The Commission said it had begun a review and was taking “appropriate corrective action.” It added that the online publication does not reflect all ongoing data-cleanup activities, and that it was examining possible technical or procedural lapses.
INEC also said the preliminary register is not the final certified version, which it plans to certify on 15 December 2026.
SERAP said INEC has reportedly indicated that some registration officers may have used their official access credentials to introduce irregular records, including photographs suspected to have been generated with artificial intelligence.
SERAP said: “The security and accuracy of the voter register are fundamental to the protection of Nigerians’ personal data and their right to participate in public affairs. Nigerians should not have to worry that their personal information could be altered, manipulated or accessed without proper safeguards.”
The organisation argued that an internal review by INEC cannot replace the NDPC’s independent exercise of its statutory mandate. “The public needs to know what happened, whether the law was breached and what measures are being taken to prevent a recurrence,” the letter read in part.
SERAP said the proposed investigation should establish the number and geographical distribution of affected records, when and how they were created or altered, and the persons or institutions responsible.
It also urged an independent forensic examination of the affected database and systems to determine whether personal data were unlawfully accessed or altered and whether INEC complied with the Act.
The group further asked that the NDPC determine whether the incidents amount to a personal data breach under section 65 of the Act, and whether INEC met its notification and record-keeping obligations.
Under section 40, data controllers must notify the NDPC of a breach likely to pose a risk to individuals’ rights and freedoms within 72 hours of becoming aware of it. Sections 24 and 39 require personal data to be processed accurately and securely and protected against unlawful alteration, loss or unauthorised access.
SERAP also stressed that the use of authorised credentials does not by itself establish that later access or processing was lawful.
It said where violations are established, corrective measures should be required, including stronger security safeguards and accessible procedures for voters to verify and correct their records.
It added that the NDPC should publish its findings and recommendations, subject to lawful protections.
The organisation said the matter also touches on constitutional and international rights, citing section 37 of the 1999 Constitution (as amended), which guarantees the right to privacy, as well as Article 13 of the African Charter on Human and Peoples’ Rights and Article 25 of the International Covenant on Civil and Political Rights, which protect the right to participate in government and to vote in genuine elections.
“Nigerians must be able to trust that the register on which the 2027 general elections will be conducted is accurate, reliable and adequately protected against manipulation,” the letter stated.
SERAP said it would welcome action within seven days of receipt or publication of the letter. “If we have not heard from you by then, SERAP shall consider appropriate legal actions and other lawful measures to compel your government, the NDPC, INEC and other relevant authorities to comply with our requests in the public interest.”
