Nigeria Data Protection Act, 2023: What it means and how Multichoice ‘violated’ it

 Nigeria Data Protection Act, 2023: What it means and how Multichoice ‘violated’ it

Nigeria’s Data Protection Act explained: What it means for your privacy, your rights, and why Multichoice was fined for breaking it.

In today’s hyper-connected world, personal data is more valuable than ever—yet it’s also more vulnerable. From what we watch on TV to the apps we download, companies are constantly collecting information about us. But what happens when that data is misused or collected without our permission?

That question came into the spotlight recently when Multichoice Nigeria was fined ₦766 million by the Nigeria Data Protection Commission (NDPC) for violating the Nigeria Data Protection Act, 2023.



The fine not only marked a significant enforcement of Nigeria’s data privacy laws but also brought attention to a law many Nigerians know little about. So, what is the Nigeria Data Protection Act? Why was it introduced? And how exactly did Multichoice breach its provisions? This report breaks it all down in simple terms—because understanding your data rights is no longer optional, it’s essential.Why was the Nigeria Data Protection Act, 2023 introduced?

The Nigeria Data Protection Act (NDPA), 2023 was signed into law in June 2023 by President Bola Ahmed Tinubu. Its purpose is to safeguard Nigerians’ personal data in an increasingly digital society where private companies, government agencies, and tech platforms collect and process data every second.

Before this law, Nigeria relied on non-binding regulations like the Nigeria Data Protection Regulation (NDPR) 2019, which lacked full legal authority. The NDPA filled that gap by becoming Nigeria’s first comprehensive data protection law, in line with global standards such as the European Union’s General Data Protection Regulation (GDPR).

The Act was introduced to:

  • Promote digital trust and economic growth



  • Safeguard the privacy of Nigerian citizens

  • Prevent misuse of personal data by both local and foreign entities

  • Establish a clear legal framework for data collection, usage, and storage

  • Create a formal institution (NDPC) to enforce compliance and handle violations

Key highlights of the Nigeria Data Protection Act, 2023

The NDPA is a powerful law that gives Nigerians legal rights over their personal information. Here are the major sections of the Act and what they mean in everyday language:



1. Personal Data and Sensitive Data Defined

The Act clearly defines what counts as personal data, including:

  • Names, addresses, and phone numbers

  • Emails, bank details, and biometric data

  • Online identifiers like IP addresses or device IDs



  • Viewing habits, purchase history, or behavioural profiles

It also defines sensitive personal data, such as:

  • Health records

  • Religion

  • Sexual orientation

  • Political views

  • National identification numbers (like NIN or BVN)

These types of data require extra protection and should only be processed under strict conditions.

2. Lawful Basis for Data Collection

Companies must have a valid reason to collect and process your data. The acceptable grounds include:

  • With your consent

  • To fulfill a contract you’ve entered

  • To comply with the law

  • To protect someone’s vital interests

  • For legitimate business interests (but not at your expense)

In Multichoice’s case, NDPC said the company processed data without proper consent and from individuals who never subscribed—making the collection unlawful.

3. Transparency and Consent Requirements

The law requires companies to:

  • Explain why they’re collecting data

  • Get clear and informed consent before processing

  • Allow users to opt out at any time

  • Write privacy notices in simple and clear language

Multichoice was found to have violated this by collecting and processing personal data without full disclosure, especially from non-customers.

4. Restrictions on Cross-Border Data Transfers

Under the NDPA, personal data can only be sent outside Nigeria if:

  • The destination country has adequate data protection laws

  • The company puts safeguards in place

  • The individual consents to the transfer

  • It’s necessary to fulfill a contract or protect someone’s interests

Multichoice reportedly transferred data across borders without meeting these legal safeguards—raising privacy and security concerns.

READ ALSO

Multichoice’s N766m fine: What is data privacy violation and how does it affect you?

What happens to Multichoice Nigeria after N766m fine and how the legal process works

5. Data Minimization and Purpose Limitation

Organisations must only:

  • Collect data they truly need

  • Use it only for the stated purpose

  • Avoid using it for unrelated marketing or profiling unless permitted

NDPC accused Multichoice of collecting excessive data—a practice considered “intrusive and disproportionate.”

6. Rights of Data Subjects (You)

The Act empowers every Nigerian to:

  • Access their data

  • Request correction of errors

  • Demand deletion of their data

  • Withdraw consent at any time

  • Object to automated decisions (like being profiled without human input)

If a company fails to honour these rights, individuals can lodge complaints with the NDPC and seek compensation—just like what happened in the Multichoice case.

7. Mandatory Appointment of Data Protection Officers (DPOs)

Every organisation processing significant data must appoint a Data Protection Officer to:

  • Monitor compliance

  • Conduct regular audits

  • Train staff on data handling

  • Serve as a contact point with the NDPC

Failure to appoint or empower a DPO can lead to sanctions. Multichoice is now expected to strengthen this function.

8. Powers of the Nigeria Data Protection Commission (NDPC)

The NDPC was established by the Act to enforce compliance. It can:

  • Investigate violations

  • Issue fines and sanctions

  • Suspend operations of non-compliant data processors

  • Order companies to compensate victims

  • Recommend criminal prosecution in serious cases

Multichoice is one of the first major firms to face such heavy enforcement under the Act—proving the NDPC’s readiness to use its powers.

How Multichoice Nigeria violated the NDPA

Based on NDPC’s findings, Multichoice Nigeria violated the Act by:

  • Processing personal data without valid consent

  • Gathering data from individuals who were not subscribers

  • Making unauthorised international transfers of data

  • Failing to give users full control over their data

  • Operating in ways that were intrusive, unfair, and excessive

This led to the ₦766.2 million fine, public naming, and mandatory reforms. It was a clear test case for the new law—and a warning to other companies.

Why this law matters to you

Whether you’re using a banking app, watching TV, ordering food, or signing up for a promo, your data is constantly being collected. Without legal protection, companies could:

  • Sell your information without telling you

  • Profile you for ads or political targeting

  • Leak your sensitive information through weak security

  • Deny you access to your own data

The Nigeria Data Protection Act, 2023 is your digital shield. It means you now have enforceable rights, and companies must treat your data with care, dignity, and transparency.

A new chapter in Nigeria’s digital evolution

The NDPA is more than just a law—it’s a tool for digital freedom and consumer justice. By holding Multichoice accountable, the government is showing that data protection is no longer optional—it’s the law.

As more Nigerians embrace the digital economy, understanding this Act is essential. It gives power back to the people and places responsibility where it belongs—with the companies that use our data every day.

READ ALSO

Blow for Multichoice, win for Nigerians… making sense of NDPC’s N766m fine

Multichoice slammed with N766m fine, reason, other details emerge

Why MultiChoice sold SuperSport United and what it reveals about Africa’s Pay-TV crisis

Minister promises lower DSTV prices after high-stakes meeting with MultiChoice

DStv sports-only subscription: A game-changer for African football fans?

10 things MultiChoice can do amid rising subscriber loss

MultiChoice history: From Pay‑TV pioneer to facing digital disruption

MultiChoice cuts DStv decoder price by 50% to attract subscribers

MultiChoice 50% price cuts: Has Satellite TV era come to an end?

John Ugbe, other top MultiChoice executives set to be arraigned, see reason

From over N15k to N12k — how MultiChoice reversed DStv, Gotv prices after backlash

Full list: Multichoice increases DStv, GOtv subscription prices… see new rates

“Why I haven’t renew my DStv subscription since May 2024 — Lagos resident speaks

DStv and GOtv price hikes over the years: How MultiChoice subscription costs have skyrocketed in Nigeria

MultiChoice in crisis: Price cuts, subscriber exodus, and the battle for relevance

MultiChoice, MTN Group… top 10 African businesses owned by South Africans

MultiChoice price cuts: What it means for Nigerian subscribers and the future of pay TV

Explainer: Why MultiChoice keeps increasing DStv and GOtv prices in Nigeria

 



Related post