Acts of the National Assembly, read and explained Every claim cites its section
CivicNotes

← Everyday situations

I want control over my personal data.

Find explanations about access, correction, consent and complaints.

A starting point, not a complete checklist. These explanations come from Nigeria Data Protection Act, 2023. Other laws and the details of your situation may also matter.

Draft explanations. Under editorial review; not yet approved for publication.

  1. Your right

    The right to know what a company holds about you, and get a copy

    You can ask a data controller covered by the Act whether it processes your personal data, why, who receives it, how long it will keep it, and where it obtained it. You can request an electronic copy. If providing the copy would impose unreasonable costs, the controller may require you to bear some or all of those costs.

    Conditions & practical details
    Who this applies to
    Anyone whose personal data is processed under the Act.
    How to use it
    Write to the organisation, or its Data Protection Officer if it has one, and ask. They must respond without unreasonable delay.
    Full explanation →s. 34(1)(a) and (b)

  2. Your right

    The right to correct or delete your data

    You can request correction of inaccurate, out-of-date, incomplete or misleading personal data, or deletion where correction is not feasible or suitable. You can also request erasure. Erasure is not automatic in every case: lawful retention obligations and other exceptions may apply. The controller must erase data it no longer needs or has no lawful basis to retain.

    Conditions & practical details
    Who this applies to
    Anyone whose personal data is processed under the Act.
    How to use it
    Write to the controller identifying the data and the correction or erasure you want. Ask it to explain any lawful basis for retaining the data. NDPC GAID 2025 article 38 sets out exceptions, including legal obligations and legal claims.
    Full explanation →s. 34(1)(c), (d) and (2)

  3. Your right

    Say no to direct marketing, and withdraw consent at any time

    If a company uses your data for marketing, you can object at any time and it must stop. Where you gave consent, you can withdraw it whenever you like, and withdrawing must be as easy as giving it.

    Conditions & practical details
    Who this applies to
    Anyone.
    How to use it
    Tell the company you object or are withdrawing consent.
    Full explanation →ss. 35 and 36(3)–(4)

  4. Protection

    Silence and pre-ticked boxes are not consent

    Consent must be an active choice. A pre-selected checkbox, or simply not objecting, does not count. Requests for consent must be in clear, simple language, and the company has to prove you consented.

    Conditions & practical details
    Who this applies to
    Anyone asked to consent to data use.
    How to use it
    If a service treated your silence as consent, that is grounds for a complaint.
    Full explanation →s. 26

  5. Your right

    Complain to the Commission, and claim compensation

    If an organisation mishandles your data you can complain to the Nigeria Data Protection Commission, which can order it to fix the problem and pay you compensation. You can also sue for damages in court.

    Conditions & practical details
    Who this applies to
    Anyone who is aggrieved, or who suffers injury, loss or harm from a breach of the Act.
    How to use it
    Lodge a complaint with the Nigeria Data Protection Commission (ndpc.gov.ng).
    Full explanation →ss. 46, 48(2)(b) and 51

← Explore another situationRead the whole Act →