The legal framework
Protection rests on the Nigeria Data Protection Act 2023, which put the earlier regulation on a statutory footing and created the Nigeria Data Protection Commission. Major data controllers must register with the Commission, and data subject rights follow the familiar access, correction and erasure pattern. These statutes follow the familiar pattern: lawful basis, purpose limitation, security, and rights of access, correction and objection.
Key points
| Rights | Access, correction, objection, and erasure under the more recent statutes |
|---|---|
| Registration | Data controllers must often register with the regulator |
| Breach notification | Required under most of these Acts |
| Cross-border transfers | Permitted subject to adequacy or safeguards |
| Regulator | Nigeria Data Protection Commission |
| Sectoral rules | Telecommunications and financial regulators impose additional confidentiality duties |
| Data controllers of major importance | Must register with the Commission and file annual returns |
| Compensation | The Act allows the Commission to order redress to the individual |
| Lawful bases | Modelled on the European framework, including legitimate interest |
In practice
- Write to the organisation first, citing the relevant statutory right; keep proof of the date.
- Set out clearly what you want: a copy of your data, deletion, or an end to marketing.
- If there is no adequate reply within the statutory period, complain to the regulator — it is free.
- For dating, health and fertility apps, ask specifically about third-party sharing and overseas transfers.
- Complain to the Commission online; the process is free.
- Consider a fundamental rights application in parallel, which can be faster.
Cost and coverage
Complaints to the regulator are free.
Recent changes
Digital lending applications that harvest contact lists have become the most common subject of enforcement across the region, alongside unsolicited marketing.
Where to go
- Nigeria Data Protection Commission — complaints and guidance.
- Telecommunications regulator for mobile and SMS abuse.
- Consumer protection body for related commercial disputes.
Worth knowing
Where a foreign platform is involved, the GDPR often applies in parallel if the company operates in Europe. Complaining in both places at once is legitimate and frequently faster. The Commission can order a company to pay redress to the affected person, not merely a penalty to the state. Ask for that outcome explicitly.
Official sources and links
- Nigeria.gov.ng — official government portal