Privacy & Data Rights
Company Refuses Data Deletion Request
An organisation says it must keep your data for seven years — but that doesn't justify refusing your deletion request
Premium
intermediate
8 minutes
The Situation
What They Said
“We cannot delete your data — it is stored on our servers for seven years for regulatory compliance purposes.”
As awareness of data rights grows in Nigeria, many individuals are exercising their right to ask organisations to delete their personal data — particularly after ending a service or employment relationship. A common response from companies is to invoke a blanket 'seven-year retention' policy, citing vague regulatory obligations. While Nigerian law does impose legitimate retention requirements in specific, defined contexts — such as financial records under FIRS and CBN regulations — these requirements are narrow and purpose-specific. They cannot justify retaining all personal data indefinitely, or retaining data for purposes that have nothing to do with the original regulatory obligation. The Nigeria Data Protection Act 2023 gives every Nigerian a right to erasure, and organisations must be able to identify exactly which law requires them to retain which specific data — or they must delete it.
The Fallacy
Blanket Retention Policy Overrides Individual Rights
A company's internal data retention policy is not equivalent to a legal obligation to retain data. Even where a genuine regulatory retention obligation exists — such as a tax authority requiring financial records — that obligation is specific to certain categories of data for defined purposes. It cannot be stretched to justify retaining all personal data across all systems for every individual who has ever interacted with the company. The NDPA 2023 requires that data be retained only for as long as necessary for its specified purpose, and where no specific regulatory requirement mandates retention of a particular category of data, the right to erasure must be honoured. Companies frequently cite compliance requirements as a catch-all excuse to avoid deletion obligations they would rather not fulfil.
What the Law Says
Your Legal Foundation
Nigeria Data Protection Act 2023 (No. 14 of 2023)
Section 34(1)(e) — Right to Erasure
“A data subject has the right to require a data controller to erase personal data concerning him or her without undue delay where the personal data has been processed unlawfully or the data controller is required to erase the personal data in order to comply with a legal obligation.”
Your right to erasure is a statutory right under the NDPA. The company cannot simply refuse; it must either erase your data or identify the specific legal obligation — by act name and section — that requires retention of the specific categories of data you have asked to be deleted. A generic 'seven-year policy' without a named statutory basis does not satisfy this requirement.
Nigeria Data Protection Act 2023 (No. 14 of 2023)
Section 2(5) — Data Minimisation and Storage Limitation
“Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed.”
Even where there is a lawful retention obligation, the company may only retain the minimum data necessary to satisfy that specific obligation. They cannot use a tax-related retention requirement as a basis to keep your full profile, marketing preferences, behavioural data, or any other personal data unrelated to the compliance purpose.
Nigeria Data Protection Act 2023 (No. 14 of 2023)
Section 43 — Enforcement by the National Data Protection Commission
“The Commission may, upon receipt of a complaint or on its own initiative, investigate any processing of personal data and may issue enforcement notices requiring a data controller to take specified steps to comply with this Act, including ordering the deletion or destruction of personal data.”
The NDPC has direct enforcement powers — it can compel a company to delete your data and impose sanctions for non-compliance. Filing a complaint with the NDPC is an effective escalation route if the company refuses to engage properly with your erasure request. The NDPC can also investigate the company's retention practices more broadly.
🔒
You Know the Law — But Do You Know What to Say?
Reading your rights is one thing. Using them under pressure — calmly, correctly, in the right words — is what actually protects you. Members get the scripted rebuttal for this exact situation: what to say first, what to say if they push back, the tone to use, and the constitutional provision to cite. Practise out loud with audio until it's automatic.
Unlock This Scenario — R89/month
Identity & Dignity and Gender & Equality are free · All 17 domains from R89/month · Cancel anytime
Not ready to subscribe? Get the free checklist first.
10 South African rights scenarios — what to say, what to cite, what to refuse. Free, no card needed.
What They'll Say Next
Common Counter-Arguments
After you respond, they may push back with these arguments. Members get the full rebuttal for each.
They might say: “You're a former employee — employment law requires us to keep your HR and payroll records indefinitely.”
🔒 Subscribe to see the full rebuttal and legal counter-argument.
They might say: “We'll anonymise your data instead of deleting it — that satisfies your request and our obligations.”
🔒 Subscribe to see the full rebuttal and legal counter-argument.
Know Your Rights. Know Your Word.
149 South African rights scenarios — exact rebuttals, constitutional law, and Scripture. Practise out loud with audio. Free to start with 2 full domains.
Try Free — Identity & Dignity
No credit card · Upgrade anytime for all 17 domains