You Have the Right to Be Forgotten. Here's What That Actually Means in Nigeria.

The right to be forgotten sounds like the kind of thing people say dramatically about bad relationships or embarrassing photos. In law, it is something more specific and considerably more useful: it is the right to compel a company that holds your personal data to delete it. Not archive it or anonymize it—actually delete it.

Nigeria has this right; however, most Nigerians have never heard of it, and candidly, a good number of companies operating in Nigeria are not set up to honor it. This piece is an attempt to fix the first problem and put some pressure on the second.

Where the right comes from

The legal story of the right to be forgotten starts in Spain in 2010. A lawyer named Mario Costeja González filed a complaint with Spain’s data protection authority against Google and a newspaper called La Vanguardia. The newspaper had published a notice in 1998 about a forced property sale linked to social security debts. The sale had been resolved long ago, but the notice still appeared prominently when anyone Googled his name. González argued that the information was outdated, irrelevant, and damaging to his reputation.

The case reached the European Court of Justice, which ruled in 2014 that individuals have the right to request that search engines remove links to information about them that is inadequate, irrelevant, or no longer relevant. The principle was subsequently codified into Article 17 of the GDPR, which came into force in 2018. It is now one of the most invoked data rights in the world.

Nigeria followed. Section 34(1)(d) of the Nigeria Data Protection Act 2023 gives every data subject the right to obtain from a data controller the erasure of personal data concerning them. Section 34(1)© goes a step further: where correction of inaccurate, incomplete, or misleading data is not feasible, the data must be deleted entirely. Both provisions have been in force since 2023.

When the right applies

Neither the GDPR nor the NDPA gives you an unlimited right to demand deletion of anything you dislike. Both frame the right around specific triggering circumstances.

Under the NDPA, you can request erasure when your personal data is no longer necessary for the purpose for which it was collected. If you opened an account with a fintech app five years ago, closed it, and the company is still holding your BVN, phone number, and transaction history, the data may no longer be necessary for any legitimate processing purpose. You can ask for it to be deleted.

You can also request erasure where you withdraw consent and there is no other lawful basis for the company to continue processing your data. Where you previously consented to a company using your data for marketing and you have since withdrawn that consent, continued retention without another legal justification gives you a basis to request deletion.

The right also applies where the data has been unlawfully processed in the first place, meaning the company collected or used your data without a valid legal basis at any point.

When the right does not apply

This is important, because the right to erasure is one of the more misunderstood provisions in data protection law. It is not absolute, and companies are not obliged to comply with every deletion request they receive.

The NDPA preserves the company’s right to refuse where continued processing is necessary to comply with a legal obligation. Banks, for example, are required under anti-money laundering laws to retain customer transaction records for a specified number of years. A bank that receives a deletion request for that data is not obliged to comply while the legal retention period is running. The same applies to pension administrators, insurers, and any regulated entity operating under a framework that mandates retention.

Companies can also decline where the data is necessary for the establishment, exercise, or defense of legal claims. If you are in a dispute with a company and they hold data that is relevant to that dispute, they are entitled to retain it for the purpose of the proceedings.

The GDPR additionally preserves processing for freedom of expression and public interest research and archiving. The NDPA does not enumerate these exceptions as explicitly, which is one of the gaps between the two regimes, though the general proportionality principles in the NDPA give data controllers some basis to invoke comparable reasoning.

The critical gap: Nigeria has no response deadline.

This is where the NDPA falls short of the GDPR in a way that matters practically to every Nigerian exercising this right.

Under the GDPR, a data controller has one month from the date of receiving a valid erasure request to respond. That is a hard deadline. The controller must either comply, confirm that the data has been deleted, or explain in writing why one of the exceptions applies. Failure to respond within one month is itself a violation that can be reported to the supervisory authority.

The NDPA has no equivalent. Section 34 requires erasure “without undue delay” and “without constraint,” but it does not specify what “undue delay” means in terms of days or weeks. The NDPR 2019, which pre-dated the NDPA, had a timeline, but the NDPA moved away from prescribing one. Multiple practitioners who work in this space have flagged this as a gap that needs to be addressed, either through NDPC guidance or through a formal amendment. As things stand, a Nigerian company that sits on a deletion request for three months has a plausible technical argument that it has not yet violated the statute, while a European company in the same position would have been in breach after 30 days.

The NDPC’s General Application and Implementation Directive, issued in March 2025, does not resolve this gap. It addresses compliance audit returns, data protection officers, and processing frameworks but does not fill in a response timeline for data subject rights requests. This is the most pressing area where Nigerian data protection law needs supplementary guidance, and the NDPC should issue it.

How to actually exercise the right

The NDPA does not prescribe a specific form for making a deletion request. Practitioners have generally confirmed that a written request is sufficient, including a message sent through a company’s official contact channels, by email, or even in writing through their app. You do not need to cite the section number, though doing so signals that you know your rights and tends to accelerate compliance.

Your request should clearly state that you are requesting the deletion of your personal data, identify which data or categories of data you are concerned with if you can, and state the basis on which you are making the request, that the data is no longer necessary, that you are withdrawing consent, or whichever ground applies to your situation.

Keep a record of the date you sent the request and the channel through which you sent it. If the company does not respond or refuses without adequate explanation, you can file a complaint with the NDPC under section 34(2) of the Act, which expressly provides for complaints to the Commission where a data subject’s rights are not respected.

What this looks like in practice

Think about the number of apps, platforms, and services you have signed up for over the past five years and quietly abandoned. It could be the food delivery app you used once or the e-commerce site where you made two purchases in 2020 or perhaps even the fintech that never passed KYC. Each of those companies holds personal data about you, and in many cases they have no ongoing purpose that justifies retaining it.

Think about the social media posts, tagged photos, or community forum comments that a younger version of you would rather not have associated with your name. The right to erasure does not cover everything. It cannot compel a newspaper to remove a factually accurate article about a public figure. It also cannot override a court order or a regulatory retention requirement. But it can compel an app company holding stale data to delete it. It can require a fintech that lost your business to remove your profile rather than warehouse it indefinitely.

The right exists, and so does the mechanism to enforce it. The gap is the response timeline, and that gap needs to close. In the meantime, you can start exercising the right you have now, understanding its limits, and filing with the NDPC when companies ignore it.

Your data does not have to outlive your relationship with the people who collected it; the law says so as well. Perhaps just not loudly enough yet.