By Lummina Law Firm
3 September 2026
Practical perspective for the decisions ahead.
Every day, businesses collect information about you. Your name. Phone number. Email address. Identification details. Location. Financial information. Photographs. Online activity. But collecting your information does not give a business unlimited freedom to use it. The Nigeria Data Protection Act 2023 (NDPA) establishes rights for individuals whose personal data is being processed.
YOU CAN ASK TO SEE YOUR DATA
You have a right of access to personal data held about you, subject to applicable limitations under the Act.
In practical terms, you can ask an organisation: “What personal information do you hold about me?”
The NDPC itself provides a Data Subject Access Request process for this purpose.
YOUR INFORMATION SHOULD BE ACCURATE
What happens when a company has the wrong information about you? You can exercise your right to rectification. Where personal data is inaccurate, incomplete or outdated, the data subject may seek correction in accordance with the Act. This is particularly important where inaccurate information could affect: employment; financial services; credit decisions; customer accounts; or access to services.
YOU CAN OBJECT TO CERTAIN PROCESSING
The law also recognises a right to object to the processing of personal data in circumstances provided by the Act.
This is particularly relevant where an organisation is relying on certain lawful bases for processing or using personal information for particular purposes.
Your data should not simply be processed indefinitely without regard to your rights.
CAN YOU ASK FOR YOUR DATA TO BE DELETED?
In appropriate circumstances, yes. The NDPA recognises a right to erasure, commonly described as the right to be forgotten. But this is not an absolute right. There are circumstances in which an organisation may have a lawful reason to retain information. So the legal question is not simply: “Can I delete my data?” It is: “Is there a lawful reason for this organisation to continue retaining it?”
YOUR DATA MAY NOT BE SOLD OR SHARED HOWEVER A COMPANY WANTS
The NDPA regulates the processing and disclosure of personal data.
Organisations must process personal data in accordance with applicable lawful bases and data protection principles, including fairness, transparency, purpose limitation, data minimisation, storage limitation and security.
So when a company says: “We have your details on our system.” That does not mean: “We can use them for anything we want.”
YOU CAN COMPLAIN
Think your personal data has been mishandled? You can seek redress.
The NDPA provides mechanisms for enforcing data-subject rights, and the Nigeria Data Protection Commission (NDPC) is responsible for supervising compliance and receiving complaints.
Depending on the circumstances, a data subject may also have a basis for pursuing a civil claim.
AUTOMATED DECISIONS ARE NOT BEYOND SCRUTINY
The Act also recognises rights in relation to automated decision-making.
This matters as businesses increasingly use technology to make or assist with decisions affecting individuals.
Where applicable, data subjects have protections relating to decisions made solely through automated processing, including the right to human intervention in appropriate circumstances.
FOR FOUNDERS AND BUSINESSES
These rights create corresponding responsibilities. If your business collects customer, employee or vendor data, ask: Do we have a lawful basis for processing it? Have we told people what we are doing with their data? Can we respond to access or rectification requests? How long are we retaining personal data? Are our security measures adequate? Do our vendors and processors comply with our data protection obligations? Privacy compliance is therefore a business governance issue, not simply an IT issue.
THE TAKEAWAY PRIVACYISALEGALRIGHT.
The NDPA gives data subjects meaningful rights over how their personal data is collected, used, stored and shared.
For individuals: Know what information organisations hold about you.
For businesses: Know why you hold it—and whether you are legally entitled to process it
