Nigeria’s Data Protection Act: The Rights Every Loan-App Borrower Has
Your data is not the lender's property. The NDPA rights — consent, access, correction, deletion — translated into loan-app language you can use today.
Every loan-app dispute is secretly two disputes: one about money, one about data. Nigeria’s data-protection law, the NDPA 2023, arms you for the second — the one lenders fear, because data rights come with a regulator, penalties, and paperwork they cannot argue their way around.
Right to informed, specific consent
Consent must be freely given, specific, informed and unambiguous — not a single pre-ticked bundle trading a ₦10,000 loan for your contacts, photos and SMS. If the app’s real price was your mother’s phone number, the law required that price to be displayed on the label. What each permission actually buys the operator is decoded in the permissions guide.
Right to purpose limitation
Data collected to assess a loan cannot lawfully be repurposed into a shame-blast mailing list. “Recovery” is a purpose; public defamation is not a lawful processing purpose under any reading. This single principle is why the data-protection complaint is so punishing against contact-blast lenders.
Right of access
You may ask an organisation what data it holds about you, where it came from, and who it has been shared with. For a borrower, the answer to “who received messages about my loan?” is discoverable — in writing. Put access requests in writing, dated, to the operator’s official channel.
Right to correction
Wrong data — a phantom loan, a false default, misspelled identity merged with someone else’s file — must be corrected on request. This runs parallel to the credit-bureau dispute in the credit-report guide: the lender is the source; the bureau is the mirror. Correct the source and demand the record trail.
Right to deletion and to withdraw consent
Where processing had no lawful basis, or consent is withdrawn, data must be deleted — including your harvested contact list where it never should have been copied. After a loan ends, ask in writing: what are you retaining, why, and what has been deleted? Their answer, or silence, becomes part of your complaint record.
Right to complain
The Act gives you a formal escalation path: written request to the organisation first, then the Nigeria Data Protection Commission. The full sequence — with what remedies look like — is in our NDPC complaint walkthrough.
Exercising the rights without theatrics
- One letter, plain language, dated: identify yourself; state the right you are exercising; state what you demand (stop, correct, delete, disclose); give 14 days.
- Keep the thread on the record — email, not phone. Every subsequent abuse after your request compounds their exposure.
- Pair legal tracks: the conduct goes to the consumer-protection commission (FCCPC guide); the data goes to the data commission. Two files, one evidence folder.
The mindset shift
Borrowers are trained to see themselves as supplicants. The NDPA inverts that for everything data-related: the lender is a custodian, you are the owner, and there is a regulator whose entire job is the difference. Know your rights generally — then know these specifically, because they are the ones with their own enforcement machinery.
You can lose an argument about money. You cannot lose an argument about who owns your data.