How to File a Data-Protection Complaint Against a Loan App
Your contacts were not the lender's to use. Under the Nigeria Data Protection Act, the misuse of your data is a separate violation — here is how to complain.
When a loan app messages your contacts, it commits two wrongs at once: harassment of you, and unlawful processing of personal data — yours and your contacts’. Nigeria’s data-protection law gives you a formal route to complain about the second one, and it is a route regulators have used against digital lenders.
The law in one paragraph
The Nigeria Data Protection Act (NDPA) 2023 governs how organisations handle personal data. Its core demands map directly onto loan-app abuse: processing must be lawful and based on proper consent or another legal basis; it must be for a specified, legitimate purpose; it must be adequate and not excessive; and data must not be disclosed to third parties without a lawful basis. Messaging your sister about your debt fails on multiple counts — she is a third party, her number was collected for no purpose she ever agreed to, and “debt collection by public shame” is not a lawful basis anyone recognises.
Step one: complain to the lender first
Under the framework, start by making a written data-subject request to the organisation itself: identify yourself, state that your personal data (and your contacts’ data) has been processed unlawfully, and demand that it stop, that the data be deleted where required, and that they confirm in writing. Give a short, stated deadline. Most will ignore you — which is fine; their silence is itself evidence for the next step.
Step two: escalate to the Commission
The Nigeria Data Protection Commission (NDPC) enforces the Act. File through its published complaint channels, and structure the complaint like a case file:
- Who you are and how to reach you.
- Who the data controller is — the app, its developer name, and the registered company behind it.
- What data was misused: your contact list, your contacts’ numbers, your loan details.
- How you know: dated screenshots of the messages sent to third parties; recipient statements.
- Your prior request to the lender and their response (or silence).
- The remedy you seek: investigation, cessation, deletion of unlawfully held data, sanctions.
File the FCCPC complaint too
Data misuse and consumer harassment are separate jurisdictions. The consumer-protection commission punishes the unfair treatment; the data commission punishes the unlawful processing of the contacts’ data. Strong files go to both — use our step-by-step FCCPC guide for that half, and cross-reference the complaint numbers in each.
What remedies look like
The Commission can investigate controllers, order corrective action, and impose penalties — and digital lenders have faced exactly this machinery. Outcomes for complainants range from the abuse stopping and data being deleted, to formal enforcement against the operator. It will not wipe out a debt you genuinely owe; it attacks the method, not the arithmetic.
Strengthen every future complaint: know what you consented to
Half of a data complaint is showing what the app actually asked for at install time. Read what each permission really grants, revoke what you can, and screenshot the app’s permission demands before you delete it — that is the consent record your complaint will rest on. The rights behind all this are set out in your rights under the NDPA.
Your contact list is your network, not their collection department. The law agrees.