Introduction
In today’s data-driven economy, the frequency of disputes over the use and protection of personal data is increasing. These disputes, which are no longer hypothetical but real and financially significant, range from customers alleging misuse of their personal information to former employees contesting unlawful data processing. This increasing trend underscores the growing accountability of organisations in Nigeria under a burgeoning body of data protection laws and the scrutiny of an active regulator.
The Nigeria Data Protection Act (NDPA) 2023, together with the General Application and Implementation Directive (GAID) 2025, not only provides a clearer legal and procedural framework for addressing data-related complaints but also empowers individuals to take action. These instruments, while imposing strict obligations on data controllers and processors, ensure a fair and balanced resolution process.
This article examines how disputes arise, the formal and alternative avenues for resolving data protection disputes in Nigeria, key takeaway from case study, considerations for businesses navigating this evolving legal landscape.
How Data Protection Disputes Arise
Data protection disputes arise when the trust between individuals and organisations breaks down — often due to poor data handling, non-compliance with legal obligations, or lack of transparency.
These disputes typically fall into the following broad categories:
- Regulatory Disputes: Involving alleged violations of statutory data protection obligations, often brought before the Nigeria Data Protection Commission (NDPC).
- Contractual Disputes: Arising from breaches of privacy clauses in service contracts or employment agreements.
- Security-Related Disputes: Triggered by data breaches, leaks, or unauthorised access due to poor cybersecurity measures.
- Rights-Based Disputes: Where individuals assert specific rights under the NDPA — such as access, erasure, or rectification — and face resistance.
Disputes often begin where transparency ends. Typical triggers include:
- Failure to obtain or prove valid consent
- Delayed or ignored data access requests
- Security breaches involving customer or employee data
- Sharing data without lawful basis or notification
These can escalate from internal complaints to formal petitions before the Nigeria Data Protection Commission (NDPC) and, ultimately, court action or public enforcement.
The NDPA Dispute Resolution Framework
The NDPA sets out a three-tiered resolution pathway:
- Initial engagement between the data subject and the data controller or processor¹.
- Regulatory complaint to the NDPC if the response is inadequate or absent².
- Further redress through the courts or other applicable dispute resolution bodies³.
The NDPC has broad powers to investigate complaints, issue compliance orders, impose penalties, or recommend other remedial steps⁴. Under the GAID, the Commission is also expected to facilitate alternative resolution methods where appropriate⁵.
Enforcement and Remedial Powers of the NDPC
The NDPC’s powers under the NDPA include:
- Investigating individual or systemic breaches;
- Conducting audits and compliance checks;
- Ordering data controllers to rectify, delete, or restrict unlawful processing;
- Imposing fines and other sanctions proportionate to the harm or non-compliance.
This dual role — as a regulatory authority and a quasi-judicial body — positions the Commission as the primary enforcement channel for data rights in Nigeria.
Courts and Alternative Dispute Resolution (ADR)
While the Nigeria Data Protection Commission (NDPC) offers a central mechanism for addressing data-related grievances, the reality is that not all disputes will be conclusively resolved through regulatory enforcement. For many data controllers and data subjects—especially in complex, commercial, or sensitive matters—judicial or alternative dispute resolution (ADR) mechanisms offer viable and, in some cases, preferable options.
The Court System: Traditional Redress with Legal Authority
Litigation remains the most formal avenue for dispute resolution in Nigeria. Under the Nigeria Data Protection Act (NDPA) 2023, data subjects have the right to seek redress through the courts, particularly where:
- Compensation is being sought for a data breach;
- There is a need for injunctive relief or a declaration of rights;
- The NDPC’s action (or inaction) is considered inadequate;
- A public or precedent-setting resolution is desirable.
Litigation may be the most preferred option where parties seek enforceable, precedent-setting outcomes.
Is Alternative Dispute Resolution (ADR) an Option?
Yes—and it should increasingly become part of every data controller’s risk management and compliance strategy.
The General Application and Implementation Directive (GAID) 2025 encourages the amicable resolution of data disputes, particularly where there is an ongoing relationship between parties—for example, between employers and employees or between service providers and customers.⁶ ADR offers speed, flexibility, and confidentiality—factors that are crucial when managing data protection matters with reputational or business continuity implications.
While rarely invoked in publicised data protection disputes, arbitration holds potential—especially in business-to-business (B2B) ⁷ relationships involving cross-border data flows or vendor agreements. Key benefits include:
- Procedural confidentiality;
- Flexibility to appoint data-savvy arbitrators;
Case Study: FCCPC v. Meta Platforms Inc. ⁸
In July 2024, Nigeria’s Federal Competition and Consumer Protection Commission (FCCPC), in collaboration with the NDPC, imposed a fine of $220 million on Meta Platforms Inc. for violating Nigerian consumer and data protection laws. The investigation revealed that Meta engaged in discriminatory and exploitative practices toward Nigerian consumers, including:
- Unauthorised Data Collection: Processing user data without explicit consent.
- Exploitative Privacy Policies: Implementing terms that disadvantaged Nigerian users compared to those in other jurisdictions.
- Lack of Transparency: Failing to provide clear information on data usage and sharing practices.
Meta’s appeal against the fine was unsuccessful, with the Competition and Consumer Protection Tribunal upholding the original decision in April 2025. This case underscores the importance of multinational corporations adhering to local data protection regulations and the Nigerian authorities’ commitment to enforcing compliance.
Key Takeaway: Organizations, regardless of size or origin, must ensure that their data protection practices align with Nigerian laws to avoid substantial penalties and reputational damage.
Business Considerations: Building Readiness, Not Just Defense
Too often, businesses view compliance as a checklist. But in a dispute, it’s the evidence you didn’t prepare that can cost you the most.
Here’s how to be ready:
- Document every consent—and be prepared to show when and how it was obtained.
- Maintain a simple complaints policy that is accessible via your website and your privacy policy.
- Train your data team on timelines and tone for handling data subject requests.
- Consider including pre-dispute alternative dispute resolution (ADR) clauses in vendor contracts or data-sharing agreements to facilitate effective resolution of disputes.
- Appoint a DPO or DPCO to manage escalation.
Conclusion
Effective dispute resolution in the digital age is not just about defending legal positions — it’s about demonstrating a culture of transparency, accountability, and respect for data rights. The NDPA reflects this shift, requiring organisations to take both preventative and remedial steps seriously.
While the courts remain a vital avenue, the increasing use of regulatory adjudication, mediation, and arbitration reflects a maturing data protection environment. Businesses that adopt these options early and embed compliance into their operations will not only reduce litigation risk but also strengthen their trust, reputation, and resilience in Nigeria’s growing digital economy.
This article is intended for informational purposes only. It does not constitute legal advice and should not be relied upon for that purpose. Data protection laws are subject to change and may affect different entities differently. We recommend consulting a qualified legal professional for advice specific to your circumstances.
For further information or assistance with data protection compliance and advisory services, please contact the Lex Luminar team at support@lexluminar.com
Footnotes
- NDPA 2023, s.30(1).
- Ibid., s.46.
- NDPA 2023, s.50, 51;
- NDPA 2023, s.47; the Commission may issue administrative sanctions, including fines.
- GAID 2025, Art. 21.5, which encourages the use of ADR before regulatory escalation.
- GAID 2025, Art. 21 notes that personal data processing between a data controller or a data processor and a data subject making provision for Alternative Dispute Resolution (ADR) mechanisms.
- Arbitration in data disputes is more feasible where B2B contracts are involved.
- Reuters, “Nigerian tribunal upholds $220 million fine against Meta for violating consumer, data laws,” April 25, 2025. (reuters.com)