Nigeria Data Protection Act 2023
It is your data. You are allowed to ask what they have done with it.
Any company holding your personal data owes you an answer, free of an explanation — they cannot ask why you want it. Find the company and ask.
- Without undue delay
- the standard they are held to — NDPA 2023 §§34(1)(d), 34(2), 38(2)(a); timing reserved to the Commission by §38(3)(b) and not prescribed in GAID 2025
- No reason
- needed to ask — they cannot make you explain yourself
- Ask what for
- if they want a fee — a company that charges you should be able to say what it is charging under. Ask it, and keep the answer.
Companies you can ask right now
These run their rights page through Asiri, so what you asked and the day you asked it are recorded the moment you send it — rather than being whatever they remember later.
No company has opened a rights page here yet.
Not here? Every company holding your data owes you the same answer whether or not it uses Asiri — email their data protection officer, or the address in their privacy notice, and keep the date you sent it. That date is the only thing you need to prove if they ignore you.
Six things you can ask for
See what you hold about me
A copy of your personal data and an explanation of what it is used for.
The most common request, and the one with the most in it. You will get a file rather than a screen.
Correct something that is wrong
Fix an inaccuracy — a wrong date of birth, a misspelt name, an address you moved from.
Say what is wrong and what it should be. If they disagree, they must tell you why and record your objection alongside.
Delete what you hold
Erase your data where there is no lawful reason to keep it.
Not absolute. A bank must keep transaction records by law, and will say which records it cannot delete and under what rule.
NDPA 2023, §34(1)(d)
Stop marketing to me
Withdraw consent, or object to direct marketing.
Needs no identity check at all — an ID demand for an unsubscribe is itself a failure.
Send my data somewhere else
A machine-readable copy, to you or to another provider.
Applies where the data was given by you and is processed by consent or contract.
NDPA 2023, §38
A person should review this decision
Object to a decision made about you by a machine alone.
A declined loan, a blocked account, a flagged transaction. You are entitled to a human looking at it.
What they may ask you for, and what they may not
A company must check you are who you say you are — otherwise answering a request is how it hands your data to somebody else. The Act asks for reasonable measures. It does not ask you to prove yourself twice.
Reasonable
The email or phone number they already hold for you
a code to it proves as much as a document
Two facts only you and they would know
the last four of an account, the month you joined
A document, only where the data is sensitive
health records, or where the harm from wrongly releasing is real
Refuse these
A photograph of you holding your ID
collects more than it verifies
Your BVN, for an unsubscribe
the request needs no identity at all
A notarised affidavit
the Act asks for reasonable measures, not a legal ritual
If they ignore you, or say no
You can complain to the Nigeria Data Protection Commission, and you do not need a lawyer or a fee to do it. A company that never replies has given you a stronger complaint than one that replied badly, because there is nothing for it to argue about. Keep the date you asked — it is the only thing you need to prove.