Personal Data Consent Form (Nigeria)

A Personal Data Consent Form in Nigeria grants documented consent to the action it describes, on the conditions it states.

The primary legal framework for personal data protection in Nigeria is the Nigeria Data Protection Act 2023 (NDPA 2023), which replaced the Nigeria Data Protection Regulation 2019 (NDPR 2019) as the principal legislation. The NDPA 2023, signed by President Bola Tinubu, establishes the Nigeria Data Protection Commission (NDPC) — formerly the Nigeria Data Protection Bureau (NDPB) — as the independent regulatory authority for data protection in Nigeria. The NDPC is responsible for issuing regulations, guidelines, and codes of practice; conducting audits; and enforcing data protection obligations on data controllers and processors.

Section 25 of the NDPA 2023 requires that where consent is the lawful basis for data processing, the consent must be freely given, specific, informed, and unambiguous. Consent obtained through vague or bundled terms, pre-ticked boxes, or coercion does not constitute valid consent under the NDPA 2023. Data controllers must be able to demonstrate that consent was validly obtained — a signed consent form provides this documentary proof.

The NDPA 2023 also requires data controllers processing the personal data of Nigerian citizens or residents to comply with data subject rights including: the right to access their data, the right to rectify inaccurate data, the right to erasure ('right to be forgotten'), the right to data portability, and the right to withdraw consent at any time. A compliant Personal Data Consent Form must inform data subjects of these rights at the time of consent collection.

The NDPR 2019 — which applied from 25 January 2019 until the NDPA 2023 came into force — introduced the requirement for organisations processing the personal data of more than 1,000 data subjects per year to file annual data protection audit reports with the NDPB (now NDPC), conducted by a NDPC-licensed Data Protection Compliance Organisation (DPCO).

The legal framework governing the Personal Data Consent Form (Nigeria) in Nigeria draws on several key statutes and regulatory bodies. Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) regulates corporate entities through the Corporate Affairs Commission (CAC). The Labour Act (Cap L1 LFN 2004) and the National Industrial Court of Nigeria (NICN) govern employment disputes. The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Commission (NDPC) protect personal data. The Federal Inland Revenue Service (FIRS) administers tax obligations under the Companies Income Tax Act. The Federal High Court and state High Courts have jurisdiction over civil matters. Parties executing a Personal Data Consent Form (Nigeria) in Nigeria should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Companies and Allied Matters Act (CAMA) 2020 sets the foundational requirements.

A Personal Data Consent Form in Nigeria is needed whenever an organisation collects personal data from individuals and relies on consent as the lawful basis for that data processing under the NDPA 2023.

A Personal Data Consent Form is required when a fintech company, bank, or CBN-licensed payment service provider collects customers' personal financial data — including BVN numbers, account details, and transaction histories — for credit assessment, KYC compliance, or marketing purposes, and wishes to rely on the data subject's consent as the processing basis.

A Personal Data Consent Form is needed when a hospital, clinic, or healthcare provider in Nigeria collects patients' health data (which constitutes sensitive personal data under Section 30 of the NDPA 2023) for treatment, research, or insurance purposes. Processing of health data requires explicit consent as a heightened standard.

A Personal Data Consent Form is required when an employer collects employees' personal data — including biometric data (fingerprints or facial recognition for attendance management), health information, or next-of-kin details — beyond the information strictly necessary for the employment relationship, and relies on consent as the processing basis.

A Personal Data Consent Form is needed when an e-commerce platform, social media company, or app developer collects Nigerian users' personal data for personalised advertising, third-party data sharing, or profiling purposes, where consent is the appropriate lawful basis under the NDPA 2023.

Parties in Nigeria should prepare a Personal Data Consent Form (Nigeria) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) regulates corporate entities through the Corporate Affairs Commission (CAC). The Labour Act (Cap L1 LFN 2004) and the National Industrial Court of Nigeria (NICN) govern employment disputes. The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Commission (NDPC) protect personal data. The Federal Inland Revenue Service (FIRS) administers tax obligations under the Companies Income Tax Act. The Federal High Court and state High Courts have jurisdiction over civil matters. Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A valid Personal Data Consent Form in Nigeria must contain the following elements to constitute lawful, informed consent under the NDPA 2023 and NDPC guidelines.

Data Controller Identity: The full legal name, address, and contact details of the organisation collecting the data (the data controller). For companies, include the CAC RC number under CAMA 2020. A Data Protection Officer (DPO) contact should be provided where the data controller has appointed one under Section 33 of the NDPA 2023.

Data Subject Identity: The full name and contact details of the person giving consent. For minors (below 13 years under the NDPA 2023 or below 18 years for sensitive data), parental or guardian consent must be obtained.

Categories of Personal Data: A clear description of the types of personal data being collected — for example, name, address, date of birth, BVN, health data, or biometric data. Sensitive personal data (health, biometrics, political opinions, religious beliefs) must be specifically identified.

Processing Purposes: A specific statement of each purpose for which the data will be processed. Under the NDPA 2023 and the data minimisation principle, data may only be processed for the purposes stated at the time of collection.

Data Sharing: Whether the data will be shared with third parties — including the identity or categories of those third parties — and the purpose of sharing. Cross-border data transfers must comply with Section 43 of the NDPA 2023, which requires that the recipient country provides adequate data protection.

Retention Period: How long the data will be retained, and the criteria for determining retention periods in the absence of a fixed period.

Data Subject Rights: A statement of the data subject's rights under the NDPA 2023 — access, rectification, erasure, restriction, data portability, and objection to processing — and how to exercise them.

Right to Withdraw Consent: A clear statement that consent can be withdrawn at any time, the method for withdrawal, and confirmation that withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

Signature and Date: The data subject's signature and the date of consent (DD/MM/YYYY).

Additional compliance elements for a Personal Data Consent Form (Nigeria) used in Nigeria include: Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) regulates corporate entities through the Corporate Affairs Commission (CAC). The Labour Act (Cap L1 LFN 2004) and the National Industrial Court of Nigeria (NICN) govern employment disputes. The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Commission (NDPC) protect personal data. The Federal Inland Revenue Service (FIRS) administers tax obligations under the Companies Income Tax Act. The Federal High Court and state High Courts have jurisdiction over civil matters. Forms-legal.com provides this template as a starting point for Nigeria-compliant documentation.