By Mary Onyinyechi Nnanemere
According to Thomas Redman he highlighted that, “Data is a living thing, it must be nurtured and protected”. People’s data are abused on a daily basis, as so many people do not know their data rights. Personal information is often shared, sold or used without consent. Data is collected every day in different ways. Online, websites and apps such as ChatGPT, gathering user’s information during sign-ups on apps or website. Data is also collected through a more analog means, such as at events where people are asked to fill out forms and memos, take pictures.
In Nigeria, people’s data privacy rights are often violated in these processes. Cold calls received by individuals from unsolicited marketers or messages from banks and companies simply obtained from registration process. These practices raise a serious concern about data protection and individual right to their personal information used.
Section 37 of the 1999 Constitution “guarantees the privacy of citizens, their homes, correspondence, telephone conversations, and telegraphic communications”. This constitutional right forms the foundation for data protection in Nigeria. On June 12, 2023, President Bola Ahmed Tinubu signed the Nigeria Data Protection Bill into law, creating a legal framework for regulating personal data in Nigeria. This law replaced the Nigeria Data Protection Regulation (NDPR) 2019 and its Implementation Framework. Several laws have been established to protect data privacy in Nigeria, including: Nigeria Data Protection Regulation (NDPR) 2019,Freedom of Information Act (FOI Act) 2011,National Identity Management Commission Act 2007,National Health Act 2014,Nigerian Communications Commission (Registration of Telephone Subscribers) Regulation 2011,Credit Reporting Act (CRA) 2017,General Application and Implementation Directive (GAID) 2024.
The Nigeria Data Protection Act (NDPA) 2023 was enacted to protect individuals’ personal data, privacy, and fundamental rights. It also promotes a secure and trustworthy digital economy while providing recourse for data breaches. The NDPA outlines six key principles for processing personal data: Fair, lawful, and transparent processing, Data should have specific, explicit, and legitimate purpose, Data collection. Data minimization, Data retention, Data accuracy, Data security. The NDPA also introduces robust enforcement mechanisms, including a complaint system and investigations by the NDPC.
Section 35 of the NDPA provides that a Data Subject shall have the right to withdraw, at any time, consent to the processing of his/her Personal Data. Section 36(3) of the NDPA provides that where Personal Data is processed for direct marketing purposes, the Data Subject shall have the right to object, at any time, to the processing of the Personal Data concerning the Data Subject. Data Subjects are entitled under Section 34 of the NDPA to lodge a complaint with the NDPA. Penalties for non-compliance depend on the size and importance of the entity and its data volume. Fines range from ₦2 million to ₦10 million or 2% of annual gross revenue. Entities handling larger volumes of personal data are held to higher standards, with stricter penalties than those under the 2019 NDPR.
The Nigeria Data Protection Act (NDPA) 2023 has increased awareness of data privacy rights in Nigeria, supported by recent court rulings. A major case, Akosa v Domino’s Pizza (2024) involved Domino’s Pizza (Eat’n’Go Limited), fined ₦3,000,000 for unlawfully using a customer’s data for marketing without consent. The complainant, Chukwuemeka Akosa, received 16 unsolicited messages despite not providing his number to the restaurant. His complaint to Jumia Food was ignored, prompting legal action. The court held that this violated Section 39(1) of the NDPA, which protects personal data from misuse and unauthorized access. The judgment reinforces that both data controllers and processors must lawfully and securely handle personal data. It also signals that Nigerian courts now actively uphold citizens’ data rights.In MTN Nigeria Communication Ltd v. Barr. Godfrey Nya Eneye (2012), the respondent sued MTN for disclosing his private phone number, which led to unsolicited messages from unknown organizations. He claimed this violated his constitutional right to privacy and sought ₦50 million in damages. The Federal High Court ruled in his favor, awarding ₦5 million and restraining MTN from sending further messages without consent. MTN appealed, challenging the court’s jurisdiction under the Nigerian Communications Act, but the Court of Appeal upheld the judgment. The case set a vital precedent for protecting privacy and combating unsolicited communications in Nigeria.
References
- NDPA (2023) A Review of the key compliance provisions and their implications for Nigerian Businesses KPMG (2023, September) <https://home.kpmg/ng.>accessed 10th October 2025.
- Eboibi, F.E & Mac-Barango, I. (2020) telecom operators as perpetrators of spamming in Nigeria: Review of MTN Nigeria Communication Limited v. Barr. Godfrey Nya Eneye. International Review of Law and Jurisprudence (IRLJ), 2(1), 78–82. < https://www.nigerianjournalsonline.com/index.php/IRLJ/article/viewFile/845/830 > accessed 10th October 2025.
- Thom-Okoroh, B. (2025,March 24) Enforcing Data Privacy in Nigeria :The significance of the Federal High court’s judgement against domino’s pizza < https:ssrn.com/abstract=5191807> accessed 10th October 2025.