By O. G. Ogbom, Esq., Ph.D
![](https://thenigerialawyer.com/wp-content/uploads/2026/06/ELLAN.png")
![](https://thenigerialawyer.com/wp-content/uploads/2026/05/2026-Summer-IDRI-Masterclass.jpg")
Introduction
The increasing use of personal data for advertising and promotional campaigns has created significant legal questions concerning privacy, consent and the lawful processing of personal information in Nigeria. One such issue arises where an organisation proposes to extract the telephone numbers of its members or customers from an existing database and disclose those numbers to a telecommunications company for a promotional campaign.
Although the organisation may have lawfully collected and retained the telephone numbers, possession of personal data does not confer an unrestricted right to use or disclose it for any subsequent purpose.
The relevant question is whether the proposed disclosure is consistent with the purpose for which the data was originally collected and whether there is a lawful basis for the new processing.
The issue is particularly important where the proposed use is for direct marketing or advertising, having regard to the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Act General Application and Implementation Directive 2025 (GAID) issued by the Nigeria Data Protection Commission (NDPC).
Constitutional Foundation
The starting point is section 37 of the Constitution of the Federal Republic of Nigeria 1999 (as amended), which provides constitutional protection for:
“the privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications.”
The constitutional protection is significant in the context of telephone numbers and telecommunications because the Constitution expressly identifies telephone communications as falling within the sphere of protected privacy. Although section 37 predates the modern concept of digital data protection, Nigerian jurisprudence has developed to recognise that the constitutional right to privacy extends to the protection of personal data.
In Incorporated Trustees of Digital Rights Lawyers Initiative & Ors v. National Identity Management Commission (2021) 52 E-WRN 02 (CA); CA/IB/291/2020, the Court of Appeal recognised the relationship between the constitutional right to privacy under section 37 and data protection. The decision has been described as the first Nigerian appellate decision substantially addressing the nature and objectives of data protection in this context.
The importance of the case is that data privacy is not merely an administrative or regulatory concept; it forms part of the broader constitutional protection of privacy. Consequently, unauthorised use or disclosure of personal information may, depending on the circumstances, raise both statutory data-protection issues and constitutional privacy concerns.
The Nigeria Data Protection Act 2023
It is imperative to mention that the Nigeria Data Protection Act, 2023, signed into law on 12 June 2023, established the Nigeria Data Protection Commission (NDPC) and provides the principal statutory framework for the processing of personal data in Nigeria. A telephone number that identifies or can reasonably be associated with an individual constitutes personal data. Consequently, collecting, storing, extracting, transmitting or disclosing a member’s telephone number constitutes “processing” for the purposes of the Act. The organisation, therefore, cannot approach the proposed disclosure merely as an ordinary administrative transfer of information. The relevant provisions include sections 24, 25 and 26 of the NDPA.
According to section 24 of the NDPA, personal data must be processed fairly, lawfully and transparently, for specified and legitimate purposes, and only to the extent necessary for those purposes, with appropriate safeguards. Accordingly, although an organisation may have lawfully collected members’ telephone numbers for legitimate purposes such as communication, membership administration or service delivery, this does not automatically authorise their subsequent disclosure to a telecommunications company for advertising or promotional purposes, as such disclosure may constitute a new and incompatible processing purpose requiring a separate lawful basis. This principle is supported by the decision of Incorporated Trustees of Digital Rights Lawyers Initiative & Ors v. National Identity Management Commission (NIMC) (2021) LPELR-55623(CA) and the Federal High Court in Chukwunweike Akosa Araka v. Ecart Internet Services Nigeria Limited & Eat ‘N’ Go Limited, Suit No. FHC/ABJ/CS/195/2024, where the Court distinguished between the lawful processing of a customer’s telephone number for the purpose for which it was supplied and its subsequent use for direct marketing. The Court held that the contractual basis for processing the claimant’s data did not authorise its use for unsolicited marketing and found the latter to be a violation of his constitutional right to privacy and the NDPA. The decision, therefore, underscores the proposition that lawful possession of personal data for one purpose does not confer an unrestricted right to use or disclose that data for a different promotional purpose.
While section 24 of the NDPA requires personal data to be processed fairly, lawfully and transparently, section 25 provides the lawful bases for processing personal data, including consent, performance of a contract, compliance with a legal obligation, vital interests, public interest and legitimate interests. Accordingly, consent is not required for every instance of data processing. However, in Chukwunweike Akosa Araka v. Ecart Internet Services Nigeria Limited & Eat ‘N’ Go Limited, Suit No. FHC/ABJ/CS/195/2024, the Court held that although the processing of a customer’s telephone number was lawful for the purpose of performing a contract, such lawful processing did not extend to using the data for unsolicited direct marketing, for which no consent had been obtained. Thus, the existence of another lawful basis for processing does not, in itself, authorise the subsequent use or disclosure of personal data for direct marketing purposes.
Further, Article 18(1)(a) of the GAID 2025 is particularly significant to the proposed arrangement, as it expressly requires consent for direct marketing activities. A promotional caller-tune arrangement, by its nature, is intended to expose subscribers to advertising content. Accordingly, where members’ telephone numbers are disclosed to a telecommunications company for the purpose of facilitating such a promotional campaign, the processing is likely to fall within the regulatory framework governing direct marketing. In the circumstances, consent should be obtained voluntarily, specifically and on an informed basis from the affected members before their telephone numbers are disclosed, rather than relying on a blanket or implied authorisation. Such consent should clearly identify the purpose of the disclosure and the proposed promotional use of the telephone numbers.
The fact that individuals are existing members or customers who voluntarily provided their telephone numbers does not, by itself, authorise the organisation to use or disclose those numbers for every subsequent purpose. While the existing relationship may provide a lawful basis for processing personal data where such processing is necessary for the provision or administration of the relevant service, it does not automatically extend to a separate promotional or direct-marketing campaign. The purpose for which the telephone numbers were originally collected must, therefore, be distinguished from any subsequent marketing use, particularly where the proposed use involves disclosure to a third party. Accordingly, lawful possession or processing of the numbers for one purpose should not be treated as blanket authorisation for their subsequent use or disclosure for an unrelated marketing purpose.
The constitutional right to privacy guaranteed under section 37 of the Constitution and the statutory obligations imposed by the NDPA should be read together. While section 37 establishes the fundamental right to privacy, the NDPA provides the regulatory framework governing the lawful collection, use, disclosure and retention of personal data. This relationship was recognised by the Court of Appeal in Incorporated Trustees of Digital Rights Lawyers Initiative v. National Identity Management Commission (2021) LPELR-55623(CA), where the Court affirmed the nexus between personal data protection and the constitutional right to privacy. Accordingly, organisations handling personal data are expected to adopt a privacy-by-design and accountability approach, rather than treating possession of personal information as unrestricted authority to use or disclose it.
The proposed arrangement also has a telecommunications regulatory dimension, as the Nigerian Communications Commission (NCC) regulates unsolicited and promotional communications, including through mechanisms such as the Do Not Disturb (DND) framework. Accordingly, compliance with the NDPA does not necessarily exhaust the applicable regulatory requirements, and both the organisation and the telecommunications company should ensure that the proposed campaign is consistent with relevant NCC rules and subscriber preferences. This is particularly important because telephone numbers are not only personal data under the data-protection regime but also operate within a regulated telecommunications framework.
Data Minimisation
Even where consent has been obtained, the organisation must adhere to the principle of data minimisation by disclosing only the personal data necessary for the stated purpose. Thus, where the campaign requires only telephone numbers, there would ordinarily be no justification for disclosing additional information such as names, addresses, dates of birth, membership details, departmental affiliations or other unrelated personal information, consistent with the NDPA requirement that personal data be adequate, relevant and limited to what is necessary for the purpose for which it is processed.
The transfer of any database should be preceded by a clear definition and documentation of the legal relationship between the parties through a written data-sharing or processing arrangement. The agreement should specify the purpose and scope of the disclosure, categories of data to be shared, the respective roles and responsibilities of the parties, permitted uses, security measures, retention and deletion requirements, procedures for withdrawal of consent, data-breach obligations and responsibility for responding to data-subject complaints. Accordingly, the organisation should not simply transmit an Excel spreadsheet containing members’ telephone numbers to the telecommunications company without first establishing appropriate contractual and data-protection safeguards.
Conclusion
The disclosure of telephone numbers to a telecommunications company for promotional purposes should, therefore, not be regarded as a mere administrative use of an existing database. Section 37 of the Constitution protects the privacy of telephone communications, while the NDPA establishes the statutory framework governing the lawful collection, use and disclosure of personal data, including the principles of purpose limitation, lawful basis, consent, transparency and data minimisation.
In Emerging Market Telecommunication Services Ltd v. Barr. Godfrey Nya Eneye (2018) LPELR-46193(CA), the Court of Appeal upheld the protection accorded to a subscriber whose telephone number had been disclosed and subsequently used in connection with unsolicited communications, underscoring the privacy implications of unauthorised use and disclosure of telephone information.
Accordingly, where telephone numbers are to be disclosed to a telecommunications company for a promotional campaign, the organisation should obtain specific, informed and affirmative consent for that purpose, disclose only the minimum data required, properly document the consent and establish appropriate safeguards governing the recipient’s use, retention and deletion of the data. It should also provide a mechanism for withdrawal of consent and ensure compliance with applicable telecommunications requirements. The mere fact that the organisation lawfully possesses the telephone numbers does not confer an unrestricted right to disclose or use them for advertising; the purpose for which the data was collected and the legal basis for the proposed further processing must be independently established.
O. G. Ogbom, Esq., Ph.D., is a Port Harcourt-based legal practitioner. He may be reached via ogbomgoodluck@gmail.com or ogbom@lawfreightattorneys.com.ng.
The book also examines Nigeria's legal ecosystem, focusing on the LPELR and NBA AI Guidelines. As a bonus, every purchase comes with a FREE eBook titled: How to Use the AI Features in LegalPedia and LawPavilion.
Ohio Books Ltd praises the publication, stating:
"....this is the only Nigerian book I know of on the topic."
How to Order:
📞 Call, Text, or WhatsApp: 08034917063 | 07055285878
📧 Email: benadigwe1@gmail.com
🌎 Website: www.benadigwe.com
Ebook Version: Access it directly online at https://selar.com/prv626
Authored by Ben Ijeoma Adigwe Esq., ACIarb (UK), LL.M, Dip. in Artificial Intelligence, Director at the Delta State Ministry of Justice, Asaba, Nigeria.
_______________________________________________________________________
“Order Justice Omolaye-Ajileye’s Electronic Evidence Books Now” — Essential Guides On Evidence Act, Case Law And Digital Proof
Interested buyers are encouraged to place their orders and enquiries via:
0704 444 4777, 0704 444 4999, 0818 199 9888
Website: www.alexandernigeria.com
