Privacy & Data Rights
Employer Shares Employee Personal Data With Third Parties Without Consent
Your employer gave your contact details to a business partner — without asking you
Premium
foundational
7 minutes
The Situation
What They Said
“We gave your contact details to our business partner for a promotion. It's in your employment contract — we can share data within our group.”
Many Nigerian employees discover their personal data — phone numbers, home addresses, bank details — has been shared with third parties without their knowledge. Employers often justify this by pointing to broad clauses buried in employment contracts or by claiming that affiliated companies or 'business partners' are extensions of the same organisation. This is a common practice in Nigerian workplaces, particularly in sectors such as banking, telecoms, and fast-moving consumer goods. The Nigeria Data Protection Act 2023 (NDPA) now places clear obligations on employers as data controllers, and employees have enforceable rights — including the right to object — regardless of what an employment contract says.
The Fallacy
Contractual Blanket Licence
An employment contract cannot act as a blanket licence to share your personal data with any third party for any purpose. Under the NDPA 2023, consent must be freely given, specific, informed, and unambiguous — a general clause buried in a contract of employment does not meet this standard. The fact that a third party is described as a 'business partner' or a company 'within our group' does not automatically create a lawful basis for data transfer; each transfer must be independently justified. Furthermore, even where a contractual basis exists, sharing data for a promotional purpose — unrelated to the employment relationship — almost certainly exceeds the scope of any legitimate contractual justification.
What the Law Says
Your Legal Foundation
Nigeria Data Protection Act 2023 (No. 14 of 2023)
Section 24 — Lawful Basis for Processing Personal Data
“A data controller or data processor shall not process the personal data of a data subject unless the processing is necessary for a legitimate interest of the data controller or a third party to whom the data is disclosed, provided that such interest is not overridden by the interest, fundamental rights or freedoms of the data subject.”
Your employer must identify a specific, legitimate basis for sharing your data with a business partner. Sharing contact details for a commercial promotion does not fall within the scope of the employment relationship and is unlikely to constitute a legitimate interest that overrides your fundamental privacy rights.
Nigeria Data Protection Act 2023 (No. 14 of 2023)
Section 26 — Requirements for Consent
“Where the lawful basis for processing personal data is the consent of the data subject, such consent shall be freely given, specific, informed and unambiguous, and shall be obtained before or at the time of processing.”
Any consent buried in a standard employment contract is unlikely to be 'specific' or 'informed' with respect to a third-party promotional campaign. Consent obtained as a condition of employment is also questionable on the grounds of being freely given, since the power imbalance between employer and employee undermines genuine voluntariness.
Nigeria Data Protection Act 2023 (No. 14 of 2023)
Section 34 — Right to Object to Processing
“A data subject has the right to object, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her, including processing carried out on the basis of the legitimate interests of the data controller.”
You have the right to formally object to your employer's sharing of your data with third parties. Once you lodge this objection in writing, the employer must cease processing your data for that purpose unless they can demonstrate compelling legitimate grounds that override your interests.
🔒
You Know the Law — But Do You Know What to Say?
Reading your rights is one thing. Using them under pressure — calmly, correctly, in the right words — is what actually protects you. Members get the scripted rebuttal for this exact situation: what to say first, what to say if they push back, the tone to use, and the constitutional provision to cite. Practise out loud with audio until it's automatic.
Unlock This Scenario — R89/month
Identity & Dignity and Gender & Equality are free · All 17 domains from R89/month · Cancel anytime
Not ready to subscribe? Get the free checklist first.
10 South African rights scenarios — what to say, what to cite, what to refuse. Free, no card needed.
What They'll Say Next
Common Counter-Arguments
After you respond, they may push back with these arguments. Members get the full rebuttal for each.
They might say: “We are part of the same corporate group — no separate consent is needed to share data within affiliated companies.”
🔒 Subscribe to see the full rebuttal and legal counter-argument.
They might say: “The data we shared was just your name and phone number — not sensitive data, so the NDPA's stricter rules don't apply.”
🔒 Subscribe to see the full rebuttal and legal counter-argument.
Know Your Rights. Know Your Word.
149 South African rights scenarios — exact rebuttals, constitutional law, and Scripture. Practise out loud with audio. Free to start with 2 full domains.
Try Free — Identity & Dignity
No credit card · Upgrade anytime for all 17 domains