Nigeria Data Protection Act, 2023: What it means and how Multichoice ‘violated’ it

Features
crispng
July 7, 2025
74

Nigeria’s Data Protection Act explained: What it means for your privacy, your rights, and why Multichoice was fined for breaking it.

In today’s hyper-connected world, personal data is more valuable than ever—yet it’s also more vulnerable. From what we watch on TV to the apps we download, companies are constantly collecting information about us. But what happens when that data is misused or collected without our permission?

That question came into the spotlight recently when Multichoice Nigeria was fined ₦766 million by the Nigeria Data Protection Commission (NDPC) for violating the Nigeria Data Protection Act, 2023.

The fine not only marked a significant enforcement of Nigeria’s data privacy laws but also brought attention to a law many Nigerians know little about. So, what is the Nigeria Data Protection Act? Why was it introduced? And how exactly did Multichoice breach its provisions? This report breaks it all down in simple terms—because understanding your data rights is no longer optional, it’s essential.Why was the Nigeria Data Protection Act, 2023 introduced?

The Nigeria Data Protection Act (NDPA), 2023 was signed into law in June 2023 by President Bola Ahmed Tinubu. Its purpose is to safeguard Nigerians’ personal data in an increasingly digital society where private companies, government agencies, and tech platforms collect and process data every second.

Before this law, Nigeria relied on non-binding regulations like the Nigeria Data Protection Regulation (NDPR) 2019, which lacked full legal authority. The NDPA filled that gap by becoming Nigeria’s first comprehensive data protection law, in line with global standards such as the European Union’s General Data Protection Regulation (GDPR).

The Act was introduced to:

Promote digital trust and economic growth
Safeguard the privacy of Nigerian citizens
Prevent misuse of personal data by both local and foreign entities
Establish a clear legal framework for data collection, usage, and storage
Create a formal institution (NDPC) to enforce compliance and handle violations

Key highlights of the Nigeria Data Protection Act, 2023

The NDPA is a powerful law that gives Nigerians legal rights over their personal information. Here are the major sections of the Act and what they mean in everyday language:

1. Personal Data and Sensitive Data Defined

The Act clearly defines what counts as personal data, including:

Names, addresses, and phone numbers
Emails, bank details, and biometric data
Online identifiers like IP addresses or device IDs
Viewing habits, purchase history, or behavioural profiles

It also defines sensitive personal data, such as:

Health records
Religion
Sexual orientation
Political views
National identification numbers (like NIN or BVN)

These types of data require extra protection and should only be processed under strict conditions.

2. Lawful Basis for Data Collection

Companies must have a valid reason to collect and process your data. The acceptable grounds include:

With your consent
To fulfill a contract you’ve entered
To comply with the law
To protect someone’s vital interests
For legitimate business interests (but not at your expense)

In Multichoice’s case, NDPC said the company processed data without proper consent and from individuals who never subscribed—making the collection unlawful.

3. Transparency and Consent Requirements

The law requires companies to:

Explain why they’re collecting data
Get clear and informed consent before processing
Allow users to opt out at any time
Write privacy notices in simple and clear language

Multichoice was found to have violated this by collecting and processing personal data without full disclosure, especially from non-customers.

4. Restrictions on Cross-Border Data Transfers

Under the NDPA, personal data can only be sent outside Nigeria if:

The destination country has adequate data protection laws
The company puts safeguards in place
The individual consents to the transfer
It’s necessary to fulfill a contract or protect someone’s interests

Multichoice reportedly transferred data across borders without meeting these legal safeguards—raising privacy and security concerns.

What happens to Multichoice Nigeria after N766m fine and how the legal process works

5. Data Minimization and Purpose Limitation

Organisations must only:

Collect data they truly need
Use it only for the stated purpose
Avoid using it for unrelated marketing or profiling unless permitted

NDPC accused Multichoice of collecting excessive data—a practice considered “intrusive and disproportionate.”

6. Rights of Data Subjects (You)

The Act empowers every Nigerian to:

Access their data
Request correction of errors
Demand deletion of their data
Withdraw consent at any time
Object to automated decisions (like being profiled without human input)

If a company fails to honour these rights, individuals can lodge complaints with the NDPC and seek compensation—just like what happened in the Multichoice case.

7. Mandatory Appointment of Data Protection Officers (DPOs)

Every organisation processing significant data must appoint a Data Protection Officer to:

Monitor compliance
Conduct regular audits
Train staff on data handling
Serve as a contact point with the NDPC

Failure to appoint or empower a DPO can lead to sanctions. Multichoice is now expected to strengthen this function.

8. Powers of the Nigeria Data Protection Commission (NDPC)

The NDPC was established by the Act to enforce compliance. It can:

Investigate violations
Issue fines and sanctions
Suspend operations of non-compliant data processors
Order companies to compensate victims
Recommend criminal prosecution in serious cases

Multichoice is one of the first major firms to face such heavy enforcement under the Act—proving the NDPC’s readiness to use its powers.

How Multichoice Nigeria violated the NDPA

Based on NDPC’s findings, Multichoice Nigeria violated the Act by:

Processing personal data without valid consent
Gathering data from individuals who were not subscribers
Making unauthorised international transfers of data
Failing to give users full control over their data
Operating in ways that were intrusive, unfair, and excessive

This led to the ₦766.2 million fine, public naming, and mandatory reforms. It was a clear test case for the new law—and a warning to other companies.

Why this law matters to you

Whether you’re using a banking app, watching TV, ordering food, or signing up for a promo, your data is constantly being collected. Without legal protection, companies could:

Sell your information without telling you
Profile you for ads or political targeting
Leak your sensitive information through weak security
Deny you access to your own data

The Nigeria Data Protection Act, 2023 is your digital shield. It means you now have enforceable rights, and companies must treat your data with care, dignity, and transparency.

A new chapter in Nigeria’s digital evolution

The NDPA is more than just a law—it’s a tool for digital freedom and consumer justice. By holding Multichoice accountable, the government is showing that data protection is no longer optional—it’s the law.

As more Nigerians embrace the digital economy, understanding this Act is essential. It gives power back to the people and places responsibility where it belongs—with the companies that use our data every day.

Multichoice slammed with N766m fine, reason, other details emerge

Why MultiChoice sold SuperSport United and what it reveals about Africa’s Pay-TV crisis

Minister promises lower DSTV prices after high-stakes meeting with MultiChoice

DStv sports-only subscription: A game-changer for African football fans?

10 things MultiChoice can do amid rising subscriber loss

MultiChoice history: From Pay‑TV pioneer to facing digital disruption

MultiChoice cuts DStv decoder price by 50% to attract subscribers

MultiChoice 50% price cuts: Has Satellite TV era come to an end?

John Ugbe, other top MultiChoice executives set to be arraigned, see reason

From over N15k to N12k — how MultiChoice reversed DStv, Gotv prices after backlash

Full list: Multichoice increases DStv, GOtv subscription prices… see new rates

“Why I haven’t renew my DStv subscription since May 2024 — Lagos resident speaks