Your Data Privacy Rights in Nigeria — Data Protection Act 2023
Nigeria's Data Protection Act 2023 gives you the right to access, correct, and delete your personal data. Violations can be reported to the Nigeria Data Protection Commission — free.
FreeNigerian Law3 related guides
Direct Answer
The Nigeria Data Protection Act (NDPA) 2023 gives every Nigerian the right to know how their personal data is collected, used, and shared; the right to correct inaccurate data; the right to have data deleted; and the right to object to processing. File complaints with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng — free.
What the Law Says
Your Legal Foundation
Nigeria Data Protection Act 2023
Section 34
“A data subject has the right to obtain confirmation as to whether a data controller is processing personal data relating to the data subject, and to access that data.”
Nigeria Data Protection Act 2023
Section 35
“A data subject has the right to have inaccurate personal data corrected without undue delay.”
Nigeria Data Protection Act 2023
Section 40
“A data subject may lodge a complaint with the Commission against a data controller or data processor for any breach of this Act.”
What to Do
Step-by-Step Guide
1Identify the violation. Common breaches: data shared without consent, spam marketing using your number, data used for an undisclosed purpose, failure to secure your data, or refusal to delete your data when requested.
2Request action from the organisation in writing — ask them to stop processing, correct, or delete your data. They have 30 days to respond.
3If they ignore you or refuse, file a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng. Free.
4Include evidence — screenshots, emails, unsolicited messages, and a description of how you were harmed.
5The NDPC can investigate, issue enforcement notices, and fine organisations up to 2% of annual gross revenue or ₦10 million (whichever is higher) for serious violations.
What to Say
Exact Words to Use
“"Under Section 34 of the Nigeria Data Protection Act 2023, I am requesting access to all personal data you hold about me. Please provide this within 30 days."”
Tone: Written — to any organisation holding your data
“"Under Section 35 of the Nigeria Data Protection Act 2023, I am requesting the deletion of my personal data. I withdraw all consent previously given. Please confirm deletion within 30 days."”
Tone: Written — to request data deletion
Common Questions
Frequently Asked Questions
Does the NDPA replace the old Nigeria Data Protection Regulation (NDPR)?
Yes. The NDPA 2023 replaced the NDPR 2019 and created the Nigeria Data Protection Commission (NDPC) as a standalone regulatory body. The NDPA is now the primary data protection law in Nigeria.
My phone number is being used for unsolicited marketing — what can I do?
File a complaint with the NDPC and also the Nigerian Communications Commission (NCC) at 622. Telcos are required to provide do-not-call lists and must obtain consent before sharing your number with third parties.
A data breach exposed my banking or personal information — can I claim compensation?
Yes. File with the NDPC and consult a lawyer about a civil claim for damages. Organisations have an obligation to notify the NDPC and affected data subjects of a breach within 72 hours of discovery.
Does this law cover health and medical records?
Yes. Health data is a special category of personal data under the NDPA with the highest level of protection. Hospitals and insurance companies cannot share your medical information without explicit consent.
Get Help Now
Resources & Helplines
Nigeria Data Protection Commission (NDPC)
ndpc.gov.ng
File data privacy complaints here. Free.
Nigerian Communications Commission (NCC)
622 (toll-free)
Telecom data misuse and spam marketing complaints.
The Advocate gives you exact rebuttals, law references, and Scripture for real-life scenarios across workers' rights, eviction, arrest, and more. Free to try.