How to File a Data Protection Complaint in Nigeria (And Actually Win Your Case!)

Data protection has become a pressing issue in Nigeria as more organizations collect, process, and store personal data. With the Nigeria Data Protection Act (NDPA) 2023 now in effect and the Nigeria Data Protection Commission (NDPC) fully established, individuals have stronger rights to seek redress when their personal information is mishandled.

In this guide, you’ll learn how to file a data protection complaint in Nigeria, the step-by-step process, real-life scenarios, and what to expect after lodging a complaint.

Why Filing a Data Protection Complaint Matters

When organizations mishandle personal data—whether through data breaches, unauthorized sharing, or failure to secure information—the consequences can be devastating. Victims may experience identity theft, financial fraud, reputational harm, or even emotional distress.

Filing a complaint ensures:

• Accountability: Organizations are held responsible for non-compliance.
• Protection: Individuals safeguard their privacy and prevent further misuse.
• Enforcement: The NDPC can impose fines, sanctions, or corrective measures.

Who Can File a Data Protection Complaint in Nigeria?

You may file a complaint if:

• Your personal data has been exposed, leaked, or misused.
• An organization collected your data without lawful basis or consent.
• You were denied access to your personal data upon request.
• Your data was transferred without adequate safeguards.
• A company failed to comply with NDPA principles or ignored your data rights.

Example: If a fintech app shares your BVN or account details with third parties without consent, you can lodge a complaint with the NDPC.

Step-by-Step Guide: How to File a Data Protection Complaint in Nigeria

1. Gather Evidence

Before filing, collect documents that prove the violation, such as:

• Emails, SMS, or call logs.
• Screenshots of unauthorized data use.
• Written correspondence with the organization.

2. Contact the Data Controller or Processor First

The NDPA encourages resolving complaints directly with the organization before escalation. Write to the company’s Data Protection Officer (DPO) stating your concerns.

Tip: Keep copies of all correspondence—it strengthens your case.

3. Escalate to a Licensed Data Protection Compliance Organization (DPCO)

If the company does not resolve the issue, contact a DPCO accredited by the NDPC. DPCOs act as intermediaries and can help escalate your complaint officially.

4. Submit Your Complaint to the Nigeria Data Protection Commission (NDPC)

If the issue persists, file your complaint with the NDPC directly via:

• Email: complaints@ndpc.gov.ng (check NDPC’s website for updated addresses)
• Online Portal: NDPC official website (if available)
• Physical Submission: NDPC headquarters in Abuja.

5. NDPC Review and Investigation

The NDPC will:

• Acknowledge your complaint.
• Investigate the organization.
• Possibly request additional evidence.
• Provide a decision, which may include fines, corrective orders, or compensation.

Sample Complaint Letter Template

Section	Example
Subject	Data Protection Complaint Against XYZ Company
Introduction	I am filing this complaint under the Nigeria Data Protection Act, 2023, against XYZ Ltd. for unauthorized use of my personal data.
Details	On 12th March 2025, I discovered that my email address and phone number were shared with third parties without my consent.
Evidence	Attached are screenshots of unsolicited SMS messages and prior correspondence with the company.
Relief Sought	I request an immediate investigation, corrective action, and assurance that my data will be protected.
Signature	[Your Name, Date]

Real-Life Example

In 2023, a Nigerian bank was fined for sending marketing messages without customer consent. Affected customers who complained received official apologies, while the NDPC mandated compliance measures. This demonstrates the effectiveness of filing complaints.

Possible Outcomes of a Data Protection Complaint

• Warning or compliance notice to the organization.
• Fines or penalties depending on the severity of the breach.
• Compensation or redress for the complainant.
• Corrective orders, such as deleting unlawfully collected data.

Frequently Asked Questions (FAQ)

1. How long does it take for NDPC to resolve a complaint?

Typically, investigations may take 30–90 days, depending on complexity.

2. Do I need a lawyer to file a complaint?

Not necessarily, but having legal or DPCO support may strengthen your case.

3. Can I file anonymously?

Yes, but providing your details helps the NDPC investigate effectively.

4. What happens if the organization refuses to comply with NDPC’s decision?

The NDPC can impose enforcement actions and fines, and escalate matters to the courts if necessary.

5. Can I file against foreign companies operating in Nigeria?

Yes, as long as they process data of Nigerian citizens or residents.

Final Thoughts

Filing a data protection complaint in Nigeria is an essential step in safeguarding your digital rights. Thanks to the NDPA 2023 and the establishment of the NDPC, Nigerians now have a clear legal pathway to demand accountability.

If your personal data has been mishandled, don’t stay silent. Gather evidence, escalate responsibly, and seek redress through the NDPC. Protecting your data today secures your digital future.