The Socio-Economic Rights and Accountability Project (SERAP) has given President Bola Tinubu seven days to order an independent investigation into suspected artificial intelligence-generated photographs and alleged manipulation of personal data in the Independent National Electoral Commission’s (INEC) preliminary Register of Voters.
SERAP urged Tinubu to direct the National Data Protection Commission (NDPC) to investigate the reported irregularities, determine whether they constitute breaches of the Nigeria Data Protection Act 2023 and identify those responsible.
“The NDPC should exercise its statutory powers independently and without delay. Any investigation must establish the facts, protect affected voters and ensure that those responsible for any unlawful conduct are held accountable,” the organisation said.
“We would be grateful if the requested measures are taken within seven days of the receipt and/or publication of this letter. If we have not heard from you by then, SERAP shall consider appropriate legal actions and other lawful measures to compel your government, the NDPC, INEC and other relevant authorities to comply with our requests in the public interest.”
The organisation also called for measures to ensure that affected Nigerians can verify and correct their voter registration records without being wrongfully excluded from the electoral process ahead of the 2027 general elections.
In a letter dated October 31, 2026, and signed by its Deputy Director, Kolawole Oluwadare, SERAP warned that the reported irregularities raised serious concerns about the security of Nigerians’ personal data and the reliability of the voter register.
The organisation said it would consider legal action and other lawful measures to compel the Federal Government, the NDPC, INEC and other relevant authorities to act if its requests were not addressed within seven days of the receipt or publication of the letter.
The demand followed INEC’s acknowledgement of suspected AI-generated photographs and questionable registration records identified during the nationwide display of the preliminary register from October 9 to 15, 2026.
In a statement issued on October 27, INEC said some questionable registration records had been identified and flagged for further examination during the exercise.
The commission also acknowledged concerns about suspected AI-generated photographs appearing in the preliminary register published on its website.
According to SERAP, INEC said it had commenced a review and was taking corrective action while examining the circumstances surrounding the suspicious photographs, including possible technical or procedural lapses.
The electoral commission reportedly stated that the online publication did not reflect all ongoing data-cleanup activities and stressed that the preliminary register was not the final certified register.
INEC said it would complete the necessary verification, adjudication and data-cleanup processes before certifying the final Register of Voters on December 15, 2026.
However, SERAP insisted that an independent investigation by the NDPC was necessary to establish the full circumstances surrounding the reported irregularities and ensure accountability.
“An internal review by INEC cannot substitute for the NDPC’s independent exercise of its statutory data-protection mandate,” the organisation noted.
SERAP urged the commission to conduct an independent forensic examination of the affected database and systems to determine whether personal data had been unlawfully accessed or altered and whether INEC had complied with the Nigeria Data Protection Act 2023.
It also called on the NDPC to establish the number and geographical distribution of affected records, determine when and how they were created or altered, and identify the individuals or institutions responsible.
The organisation expressed concern that the reported irregularities could involve unlawful alteration or processing of personal data, misuse of authorised access credentials and inadequate safeguards against unauthorised access or manipulation.
It further asked the NDPC to determine whether the incidents constituted a personal data breach under Section 65 of the Act and whether INEC had fulfilled its applicable notification and record-keeping obligations.
SERAP warned that any unlawful alteration or compromise of the voter database could undermine public confidence in the electoral process, affect the accuracy of the register and expose eligible voters to wrongful exclusion.
It cited Section 37 of the Nigerian Constitution, which guarantees the right to privacy, as well as Article 13 of the African Charter on Human and Peoples’ Rights and Article 25 of the International Covenant on Civil and Political Rights, which protect citizens’ rights to participate in government and vote in genuine elections.
The organisation called for appropriate corrective measures, including stronger security safeguards and accessible procedures for affected voters to verify and correct their records.
It also urged the NDPC to publish its findings and recommendations, subject to lawful protections, and ensure accountability where wrongdoing was established.
SERAP maintained that the integrity and accuracy of the voter register were essential to protecting Nigerians’ personal data and their constitutional and democratic rights.
It warned that failure to investigate and address the reported irregularities before the final register was certified could undermine public confidence in the electoral process and jeopardise eligible voters’ participation in the 2027 general elections.
