Introduction to data privacy monetisation

Every day, businesses collect information about the people who use their services. Names, telephone numbers, email addresses, locations, financial information, purchasing habits and online behaviour have become valuable resources in the digital economy. For businesses, personal data can improve products, personalise services, target advertising and support commercial decision-making. This raises an increasingly important question: when personal data becomes commercially valuable, can a business legally profit from it?

The answer under Nigerian law is more complicated than simply saying yes or no. The Nigeria Data Protection Act 2023 (NDPA) recognises the legitimate use of personal data while imposing obligations designed to protect data subjects. Its stated objectives include regulating the processing of personal data, protecting the rights of data subjects and promoting responsible data practices that support Nigeria’s digital economy. The Nigeria Data Protection Commission (NDPC), established by the Act, is responsible for overseeing this framework. (National Digital Property Centre)

Can Businesses Legally Profit from Personal Data?

The important distinction is that a business having access to personal data does not mean that it has unrestricted freedom to use that data however it wishes. Consider a customer who provides a telephone number to a food-delivery platform. The number may be necessary to facilitate an order or allow the restaurant to contact the customer. But does that automatically permit the restaurant to use the same number for unrelated advertising? That is where the principle of purpose limitation becomes important.

Purpose Limitation Under Nigerian Data Protection Law data privacy and monetisation

Section 24 of the NDPA requires personal data to be processed in a fair, lawful and transparent manner and for specified, explicit and legitimate purposes. It also incorporates principles including data minimisation, accuracy, storage limitation, security and accountability. (National Digital Property Centre)

In practical terms, the purpose for which information is collected matters. A bank may legitimately process a customer’s information to provide banking services or comply with a legal obligation. A fintech company may need personal information to verify a customer’s identity. An employer may require certain information to administer an employment relationship.

However, the existence of a legitimate purpose for collecting information does not automatically establish a lawful basis for every subsequent use of that information. This is particularly significant when businesses seek to turn personal data into a marketing or commercial asset.

What Is the Lawful Basis for Processing Personal Data? data privacy monetisation

Consent is also not the only lawful basis for processing personal data.

Section 25 of the NDPA recognises several lawful bases, including consent, contractual necessity, compliance with a legal obligation, protection of vital interests, public interest and legitimate interests.

This means that the common statement that “every form of data processing requires consent” is inaccurate. At the same time, legitimate interest should not be treated as a blank cheque. A business must still consider the rights and reasonable expectations of the data subject and whether the proposed processing is justified in the circumstances.

The commercial value of the information does not remove those obligations. Direct marketing provides a useful example. The NDPA recognises a data subject’s right to object to the processing of personal data for direct marketing, including related profiling. The law therefore recognises that an individual’s information cannot simply be treated as an unlimited marketing resource once it enters a company’s database. The NDPC’s current regulatory framework further addresses how organisations should approach lawful processing and compliance. The issue has also moved beyond theory.

Using a decided case Data privacy monetisation

In Chukwunweike Akosa Araka v Ecart Internet Services Limited & Eat ‘N’ Go Limited, the Federal High Court considered issues concerning the use of a customer’s contact information obtained through the Jumia Food platform and its subsequent use in connection with direct marketing. The case illustrates the legal importance of distinguishing between the purpose for which personal information is obtained and a subsequent commercial use of that information.

The question becomes even more complicated when businesses share information with other organisations. A company may enter into arrangements involving customer analytics, advertising, cloud services, artificial intelligence or other data-driven products. The fact that such arrangements have commercial value does not remove the need to establish an appropriate legal basis and comply with the requirements governing processing. The law therefore does not necessarily prohibit businesses from deriving economic value from data. Instead, it regulates how that value may lawfully be obtained.

There is also an important distinction between personal data and genuinely anonymised information. A company may analyse customer information and produce statistics about general purchasing patterns or market behaviour. Where individuals can no longer reasonably be identified, the legal position may differ. But simply removing a person’s name from a dataset does not necessarily make the information anonymous. Other identifiers may still make an individual identifiable. This becomes increasingly important as businesses adopt artificial intelligence and automated decision-making.

The NDPA recognises rights relating to decisions based solely on automated processing, including profiling, where such decisions produce legal or similarly significant effects, subject to the exceptions provided by the Act. As businesses increasingly rely on algorithms to analyse and categorise individuals, data protection becomes not merely a privacy issue but also a question of corporate governance and risk management.

What does the law say about privacy

Privacy protection in Nigeria also has a constitutional foundation. Section 37 of the Constitution of the Federal Republic of Nigeria 1999 (as amended) protects the privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications. The NDPC itself identifies section 37 as part of the broader legal framework supporting privacy protection in Nigeria. (National Digital Property Centre)

The NDPA therefore operates within a wider legal environment in which privacy is recognised as a fundamental right. Another issue businesses must consider is retention. Personal information should not simply remain in a company’s systems indefinitely because it might become useful in the future. The principle of storage limitation requires organisations to consider how long information genuinely needs to be retained for the purpose for which it is being processed.

The significance of these obligations has increased with the implementation of the Nigeria Data Protection Act—General Application and Implementation Directive (GAID) 2025. The Directive was issued on 20 March 2025 and came into force on 19 September 2025. It provides further operational guidance on matters including compliance, data protection impact assessments, accountability and cross-border transfers. (National Digital Property Centre)

For businesses, this changes the question they should be asking. It  is no longer sufficient to ask, “Can we use this data?”

The better questions are: Why are we using it? What is our lawful basis? Did we properly inform the individual? Is the proposed use compatible with the purpose for which the information was obtained? How long will we keep it? Who will receive it? And what rights does the individual have in relation to that processing? Personal data may have significant commercial value, but that value does not make it an unrestricted corporate asset. Nigerian law allows businesses to process data for legitimate purposes while placing meaningful limits on how personal information is collected, used and shared. The issue is not whether a business can profit from personal data, but whether it can do so lawfully, fairly and responsibly.

Conclusion data privacy monetisation

personal data may be capable of generating substantial commercial value, but that value does not make it an unrestricted corporate asset. Nigerian law permits businesses to use personal data for legitimate purposes while imposing boundaries around how that data is collected, processed and commercialised. The real challenge for modern businesses is therefore not simply finding ways to profit from data, but ensuring that the pursuit of that value remains consistent with the law and the rights of the individuals behind the data.

References

Federal Republic of Nigeria. (1999). Constitution of the Federal Republic of Nigeria 1999 (as amended).

Federal Republic of Nigeria. (2023). Nigeria Data Protection Act, 2023.

Nigeria Data Protection Commission. (2025). Nigeria Data Protection Act—General Application and Implementation Directive (GAID) 2025. (National Digital Property Centre)

Nigeria Data Protection Commission. (2025). Frequently Asked Questions. (National Digital Property Centre)

Nigeria Data Protection Commission. (2026). Annual Report 2025. (National Digital Property Centre)

Chukwunweike Akosa Araka v Ecart Internet Services Limited & Eat ‘N’ Go Limited (Federal High Court, Abuja Division, 2025).

CONTRIBUTORS

OJIENOH SEGUN JUSTICE, ESQ.,

LEAD PARTNER, EKO SOLICITORS AND ADVOCATES

ITSEDE VICTORY

GRADUATE TRAINEE, EKO SOLICITORS AND ADVOCATES

data privacy Monitisation, data privacy monetisation,data privacy monetisation,data privacy monetisation, data privacy monetisation