Imagine waking up one morning to discover that a company you have never dealt with has your name, phone number and other personal information. You begin to wonder: Who gave them my data? Why do they have it? Can I ask them to delete it?
These are no longer merely questions of personal concern. Under the Nigeria Data Protection Act 2023 (NDPA), individuals have legal rights over how their personal data is collected, used and stored. The Act therefore represents an important step towards giving Nigerians greater control over their personal information.¹
One of these protections is the right to be informed. Data subjects have rights relating to information about the processing of their personal data, including access to relevant information. Individuals also have the right of access to their personal data and the right to request rectification where it is inaccurate or incomplete. The right to erasure, commonly described as the “right to be forgotten”, may also allow individuals to request deletion of their personal data in appropriate circumstances, subject to legal exceptions.²
The NDPA also recognises the right to data portability. In appropriate circumstances, individuals can obtain their personal data in a structured, commonly used and machine-readable format and transmit it to another service provider.³ They may also object to certain processing activities, including direct marketing.⁴ Furthermore, the Act provides safeguards concerning decisions based solely on automated processing where such decisions produce legal or similarly significant effects on an individual.⁵
These rights are supported by the Nigeria Data Protection Commission (NDPC), established under the Act as the regulatory authority responsible for data protection in Nigeria.⁶ Individuals who believe their rights have been violated may lodge complaints with the Commission, while the Act provides enforcement measures and remedies for violations.⁷
The courts have also recognised the broader constitutional importance of privacy and personal information. In Incorporated Trustees of Digital Rights Lawyers Initiative & Ors v National Identity Management Commission, the Court of Appeal considered the scope of the constitutional right to privacy under section 37⁸ and recognised the protection of personal information as falling within that right.⁹
For organisations, respecting these rights is more than simply having a privacy policy. They must establish effective procedures for handling data subject requests, provide transparent privacy notices, maintain appropriate records and implement adequate safeguards.
Ultimately, the NDPA 2023 gives Nigerians a stronger voice over their personal information. As our lives become increasingly digital, knowing these rights is not just useful; it is an important part of protecting ourselves in the digital age.
----
1. Nigeria Data Protection Act 2023, s 1.
2. ibid s 34.
3. ibid s 38.
4. ibid s 36.
5. ibid s 37.
6. ibid ss 4–5.
7. ibid ss 46–51.
8. Constitution of the Federal Republic of Nigeria 1999 (as amended).
9. (2021) LPELR-55623(CA).EMPOWERING NIGERIANS: HOW THE NDPA 2023
