YOUR DATA (INFORMATION), YOUR RIGHTS: A SIMPLE GUIDE TO NIGERIA'S NEW PRIVACY LAW. | Clementina E. Ukiri, Esq.

Ever wondered how you started getting random promotional SMS messages on your phone? Or how an online store you visited once seems to follow you with ads everywhere? Our personal information—our names, phone numbers, BVN, and even our location—is everywhere.

Until recently, the rules on how companies could use this information were not very strong. But that has changed. In 2023, Nigeria passed the Data Protection Act, a powerful new law that puts you in control of your personal data.

Think of it like this: your personal data is your property. You wouldn't let a stranger just walk into your house and take your things, right? This law says companies can't just take and use your data without your permission.

What the Law Means for You.

This law gives you new powers over your information. You now have the right to:

1. Ask "Why?": You can ask any company why they are collecting your information and what they plan to do with it. They must give you a clear answer.

2. Say NO: You have the right to refuse to give your data or to tell a company to stop using it.

3. See and Correct Your Info: You can go to your bank, for example, and ask to see all the information they have on you. If your name is spelled wrong or your address is old, you have the right to have it corrected.

4. Be Forgotten: If you stop using a service, you can tell the company to delete your data completely.

A Simple Guide for Businesses: How to Comply.

If you run any kind of business in Nigeria—a school, an online store, a clinic, or even a church—this law applies to you. You are now a "Data Controller," which is just a fancy name for someone who collects and uses people's personal data.

Being compliant might sound complicated, but it's about being responsible and building trust with your customers. Here are five practical steps you can take right now:

1. Know Your Customer's Data

First, figure out what personal information you collect.

Practical Example: A small fashion business on Instagram. You probably collect names, phone numbers for delivery, and home addresses. Maybe you have a list of birthdays for sending special offers. Action: Make a simple list of all this information and where you keep it (e.g., in a notebook, an Excel sheet, or your phone's contacts).

2. Get Clear Permission (Consent)

You can no longer hide permission in long, confusing "Terms & Conditions." You need a clear "YES" from your customers.

Practical Example: A local school. When a parent registers their child, your form should have a clear statement like, "We will use your phone number to send updates about your child's progress and school events." Below it, add a box for them to tick. Crucially, do not tick the box for them. They must do it themselves.

Practical Example: If you run a small supermarket and offer a loyalty card, ask the customer, "Can we use your number to send you weekly deals?" If they say yes, you can. If they say no, you can't.

3. Protect the Information You Have. You must treat your customers' data like you would treat your own money—keep it safe!

Practical Example: A small clinic. Patient files should be kept in a locked cabinet, not left on the reception desk. If the records are on a computer, that computer must have a strong password that only authorised staff know.

Practical Example: An e-commerce website. Use trusted payment services like Paystack or Flutterwave instead of asking customers to email you their card details. Make sure your website is secure (look for the "https" in the address bar).

4. Be Honest and Open.

Tell your customers what you are doing with their data. This is called a "Privacy Notice." It doesn't have to be a long legal document.

Practical Example: You can put up a small, simple sign in your shop that says: "We collect your phone number for delivery purposes and to notify you when your order is ready. We will not share your number with anyone else." For an online store, you can put this information on your checkout page.

5. Have a Plan for Mistakes.

Sometimes, things go wrong. A laptop with customer information might get stolen, or your system could be hacked. This is called a "data breach."

Practical Example: If your business phone containing your customers' contact list is stolen, this law requires you to report the incident to the Nigeria Data Protection Commission (NDPC)—the new "data police"—as soon as possible. Your plan should be simple: know who to contact at the NDPC and what information you need to give them.

Why This Matters.

For individuals, this law protects our privacy and gives us power. For businesses, it’s a chance to build trust. When customers know you respect their data, they are more likely to do business with you.

The message is simple: treat people's information with care, be honest about how you use it, and always keep it safe.

For Adverts/Publications?

Call Our Hotline: +2347057269862