Data Consent Form (Nigeria)

A Data Consent Form in Nigeria records a party's informed permission for a specified act, authorising it to proceed.

The NDPA 2023 was enacted on 14 June 2023 and establishes a thorough data protection framework for Nigeria. Section 25 of the NDPA lists the lawful bases for processing personal data, of which consent is one — alongside performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a public task, and legitimate interests of the data controller. Where consent is the chosen lawful basis, the NDPA imposes specific requirements for how consent must be obtained, recorded, and managed.

Under Section 30 of the NDPA 2023, consent for data processing must be: freely given (not coerced or conditional on services where processing is unnecessary for the service); specific (identifying the precise purpose for which consent is given); informed (disclosing who the data controller is, what data will be processed, for what purpose, for how long, and who it will be shared with); and unambiguous (expressed through a clear affirmative action — pre-ticked boxes do not constitute valid consent under the NDPA). For sensitive personal data — including health data, biometric data, racial or ethnic origin, religious beliefs, political opinions, and financial data — the NDPA requires explicit consent, a higher standard than ordinary consent.

The Nigeria Data Protection Commission (NDPC), established under the NDPA, supervises compliance with data protection obligations including consent requirements. The NDPC has powers to investigate complaints from data subjects, conduct audits, and impose administrative fines on data controllers that obtain or process personal data without a valid lawful basis. Data subjects whose consent rights are violated may also bring civil claims for compensation under Section 49 of the NDPA.

Consent under the NDPA is not permanent: data subjects have the right to withdraw consent at any time under Section 34 of the NDPA, and withdrawal must be as easy as giving consent. Organisations that rely on consent as a lawful basis must have mechanisms to record consent, manage withdrawal, and cease processing when consent is withdrawn.

The legal framework governing the Data Consent Form (Nigeria) in Nigeria draws on several key statutes and regulatory bodies. Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) regulates corporate entities through the Corporate Affairs Commission (CAC). The Labour Act (Cap L1 LFN 2004) and the National Industrial Court of Nigeria (NICN) govern employment disputes. The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Commission (NDPC) protect personal data. The Federal Inland Revenue Service (FIRS) administers tax obligations under the Companies Income Tax Act. The Federal High Court and state High Courts have jurisdiction over civil matters. Parties executing a Data Consent Form (Nigeria) in Nigeria should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Companies and Allied Matters Act (CAMA) 2020 sets the foundational requirements.

A Nigeria Data Consent Form is needed whenever an organisation processes personal data on the basis of the data subject's consent under the NDPA 2023, rather than another lawful basis.

Marketing and communications: organisations that send marketing emails, SMS messages, or other direct communications to individuals in Nigeria must obtain prior consent for such communications under the NDPA 2023 and the NCC Regulations on unsolicited bulk electronic messages. A consent form captures the specific consent for marketing communications, including the channels, frequency, and types of marketing covered.

Health and medical providers — hospitals, clinics, laboratories, pharmacies, and health insurers — must obtain explicit consent before processing health data under NDPA 2023 Section 30(3), as health data is a category of sensitive personal data requiring higher-standard explicit consent. Patient consent forms must specify the health data to be processed, the purpose (treatment, research, insurance), and sharing with third parties (specialists, insurance companies, health authorities).

Employers who process employee biometric data — fingerprint attendance systems, facial recognition access controls, health monitoring — must obtain explicit consent from employees before implementing such systems, as biometric data is a sensitive personal data category under the NDPA 2023.

Financial service providers and FinTech companies that process personal financial data beyond what is strictly necessary for providing the contracted service — such as analysing transaction patterns for marketing profiling, sharing data with credit bureaux, or using data for product development — need a consent form for these non-essential processing activities.

Researchers, universities, and market research organisations that collect and process personal data for surveys, research, or data products require consent forms capturing informed consent for research participation, data use, and potential publication of research findings.

Parties in Nigeria should prepare a Data Consent Form (Nigeria) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) regulates corporate entities through the Corporate Affairs Commission (CAC). The Labour Act (Cap L1 LFN 2004) and the National Industrial Court of Nigeria (NICN) govern employment disputes. The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Commission (NDPC) protect personal data. The Federal Inland Revenue Service (FIRS) administers tax obligations under the Companies Income Tax Act. The Federal High Court and state High Courts have jurisdiction over civil matters. Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A Nigeria Data Consent Form must contain the following elements to constitute valid consent under the NDPA 2023 and NDPC guidance.

Data controller identification: full legal name of the organisation collecting the data, registered address, RC number under CAMA 2020, and contact details for the Data Protection Officer (DPO) appointed under NDPA 2023 Section 32 (required for data controllers processing personal data of more than 2,000 data subjects in a 6-month period, or processing sensitive personal data).

Description of data to be collected: a specific, plain-language description of each category of personal data that will be collected — names, contact details, identification numbers, financial data, health data, biometric data — so the data subject knows exactly what they are consenting to.

Purpose of processing: a clear, specific statement of the purpose for which the data will be processed. Vague or catch-all purposes (e.g., 'for business purposes') do not meet the specificity requirement of NDPA 2023 Section 30. Multiple distinct purposes should be listed separately, allowing granular consent.

Data sharing and third parties: identification of any third parties with whom the data will be shared — named organisations, categories of recipients — and the purpose of sharing. For cross-border data sharing, the countries of transfer and safeguards should be disclosed per NDPA 2023 Section 43.

Retention period: the period for which the data will be retained, or the criteria used to determine the retention period, as required by the NDPA 2023 data minimisation and storage limitation principles.

Data subject rights: a clear statement of the data subject's rights under NDPA 2023 — right of access (Section 34), right to correction (Section 35), right to deletion (Section 36), right to object (Section 37), right to portability (Section 38), and right to withdraw consent — with contact details for exercising each right.

Consent withdrawal mechanism: a description of how the data subject can withdraw consent, which must be as simple as giving consent — typically an opt-out link, email address, or portal.

Affirmative consent action: a clear tick-box, signature line, or other affirmative mechanism by which the data subject gives consent. Pre-ticked boxes are invalid under the NDPA. The form must be designed so that consent is given by a positive, deliberate action.

Additional compliance elements for a Data Consent Form (Nigeria) used in Nigeria include: Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) regulates corporate entities through the Corporate Affairs Commission (CAC). The Labour Act (Cap L1 LFN 2004) and the National Industrial Court of Nigeria (NICN) govern employment disputes. The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Commission (NDPC) protect personal data. The Federal Inland Revenue Service (FIRS) administers tax obligations under the Companies Income Tax Act. The Federal High Court and state High Courts have jurisdiction over civil matters. Forms-legal.com provides this template as a starting point for Nigeria-compliant documentation.