You borrowed ₦20,000 from a loan app. A few days after the due date, your pastor, your boss and your aunty all received messages calling you a thief. Or maybe you keep getting calls from companies you never gave your number to. Your personal data has real value, and in Nigeria it is now protected by law.
The Nigeria Data Protection Act 2023 (NDPA) is the main law protecting personal data in Nigeria. It sets rules for how organisations collect, use, store and share your personal information. It gives you rights such as access, correction and deletion of your data, and it established the Nigeria Data Protection Commission (NDPC) to enforce the law.
Key takeaways
- The NDPA was signed into law in June 2023 and applies to organisations processing the personal data of people in Nigeria.
- You have rights to be informed, access, correct, delete and object to certain uses of your data.
- You can complain to the NDPC if your data rights are violated.
- Personal habits, such as privacy settings, sharing less and strong security, also matter.
What counts as personal data?
Personal data is any information that can identify you directly or indirectly: your name, phone number, email, address, BVN, NIN, photos, location data and online identifiers. The NDPA gives extra protection to sensitive personal data, such as health information, biometric data, religious beliefs, political opinions and sexual orientation.
Your key rights under the NDPA
- Right to be informed: to know who is collecting your data, why, and how it will be used.
- Right of access: to request a copy of the data an organisation holds about you.
- Right to rectification: to correct inaccurate or incomplete data.
- Right to erasure: to request deletion of your data in certain circumstances.
- Right to restrict processing in certain situations.
- Right to data portability: to receive your data in a usable format and move it to another provider.
- Right to object, including to direct marketing.
- Right to withdraw consent at any time, where processing is based on consent.
What organisations must do
Organisations that collect personal data must have a lawful basis for processing it, collect only what they need, keep it secure, be transparent through privacy notices, and report certain data breaches to the NDPC. Organisations that process large amounts of data may also have to designate a data protection officer.
How to exercise your rights
- Check the organisation’s privacy policy for contact details.
- Send a clear written request stating which right you are exercising.
- Keep a record of your request and any response.
- If you don’t get a satisfactory response, you can file a complaint with the Nigeria Data Protection Commission.
Practical ways to protect your privacy online
- Review privacy settings on social media and limit who can see your posts, phone number and location.
- Think before sharing IDs, BVN or NIN. Only share them with trusted, legitimate organisations.
- Be careful with loan apps that request access to your contacts and gallery.
- Check app permissions and remove unnecessary ones.
- Use strong passwords and two-factor authentication. See how to avoid online scams.
- Avoid posting real-time locations and travel plans publicly.
Try this this week
Spend 15 minutes reviewing the app permissions on your phone. Remove contacts and gallery access from any app that doesn’t truly need it, especially loan apps. Then tighten the privacy settings on your main social media accounts, including who can see your phone number.
Frequently asked questions
Did the NDPA replace the NDPR?
The NDPA is now the primary data protection law. The earlier Nigeria Data Protection Regulation (NDPR) of 2019 laid the groundwork, and the Act provides the overarching legal framework. Check NDPC guidance for how the instruments interact.
Can loan apps share my contacts?
Organisations must have a lawful basis to process personal data, and debt-shaming practices have drawn regulatory action. If you believe your data has been misused, report it to the NDPC and relevant regulators.
Related reading
Sources
- Nigeria Data Protection Act, 2023.
- Nigeria Data Protection Commission. Official website.
Written and fact-checked by the Mindset.ng Editorial Team in line with our Editorial Policy. This article is general information, not legal advice. Last updated: 23 September 2026.
