Introduction to data as the new oil
The phrase “data is the new oil” captures the enormous economic value extracted from personal information in the digital economy. In Nigeria, tech platforms, advertisers, banks, and global companies process vast quantities of citizens’ data—ranging from location histories and browsing patterns to biometric identifiers, financial records, and behavioral profiles—to generate revenue through targeted advertising, product development, and algorithmic services. Unlike crude oil, which the state claims as a national resource under the Constitution and petroleum laws, personal data originates directly from individuals. This structural imbalance raises a fundamental question: should data subjects be compensated when their information is commercially exploited?.
Nigerian commentators have aggressively localized this issue. In a July 2025 Vanguard publication, Precious Nwakama argued that foreign tech entities act as digital extractors, capturing Nigeria’s “digital oil” while citizens sign away their rights without financial compensation. Victor Ejechi, writing for TheCable in October 2025, questioned the ownership dynamics of Nigerian data, pointing to the reality that data generators lack structural control over how their information is monetized. A March 2025 Techeconomy report also questioned whether Nigerians are trading their data too cheaply by accepting basic app functionality in exchange for highly sensitive behavioral profiles. While the economic argument for compensation is compelling, attempting to apply a “pay-for-data” model under Nigerian law faces immense legal hurdles.
The Constitutional Barrier and NDPA Framework
Under Nigerian law, personal data cannot be treated as ordinary commercial inventory. The courts have consistently linked data protection to human dignity. Section 37 of the 1999 Constitution (as amended) guarantees that “the privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications is hereby guaranteed and protected”.
Nigerian courts have progressively interpreted this provision to encompass personal data protection. This foundation was solidified in the Court of Appeal’s decision in Incorporated Trustees of Digital Rights Lawyers Initiative & Ors v. National Identity Management Commission (2021), which affirmed that matters of personal data protection fall within the scope of the constitutional right to privacy. Because data privacy is a constitutional right, turning it into a paid product risks creating a two-tiered society where economically vulnerable citizens are pressured into selling their fundamental right to privacy just to generate income.
STUDYING THE NDPA
The Nigeria Data Protection Act (NDPA) 2023 defines personal data broadly as any information relating to an identifiable individual and establishes core principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability under Section 24. Lawful bases for processing data include consent, performance of a contract, legal obligation, vital interests, public interest, and legitimate interests (Section 25). Consent must be freely given, specific, informed, and unambiguous. Data subjects enjoy robust protections, including the rights to be informed, access, rectification, erasure, restriction, objection (especially to direct marketing), data portability, and protection from solely automated decisions (Sections 34–37).
Crucially, the NDPA provides avenues for financial redress without creating a general entitlement to payment for commercial use. Section 51 permits a data subject who suffers injury, loss, or harm from a violation to recover damages in civil proceedings. Section 48 empowers the Nigeria Data Protection Commission (NDPC), after an investigation, to order a controller or processor to pay compensation to affected data subjects or to account for profits realized from the violation. Penalties for non-compliance can reach the higher of ₦10 million or 2% of annual gross revenue for data controllers or processors of major importance. The General Application and Implementation Directive (GAID) 2025 further operationalizes the Act but does not introduce a compensation-for-use regime.
Judicial Enforcement: Penalties Over Profit-Sharing
Rather than allowing citizens to sell their data, recent Nigerian case law demonstrates that the courts are using the NDPA to strictly penalize unauthorized commercialization.
Purpose Limitation and Direct Marketing
The rule that data collected for one specific reason cannot be repurposed for commercial gain was tested in Chukwunweike Akosa Araka v. Ecart Internet Services Nigeria Limited & Eat ‘N’ Go Limited (2025). The applicant ordered food via Jumia, which shared his phone number with Domino’s Pizza solely to facilitate delivery. Domino’s subsequently used that data to send unsolicited direct marketing messages. The Federal High Court absolved Jumia but held Domino’s liable for violating the NDPA’s purpose limitation principle, awarding ₦3 million in damages for the unauthorized commercial use.
Express Consent data as the new oil
In Folashade Molehin v. United Bank for Africa Plc (2024), UBA used a customer’s existing data to open a system-generated domiciliary account for her without explicit permission. The bank argued that the action was taken in good faith to facilitate a foreign currency salary payment. The Federal High Court rejected this defense, holding that consent for data processing must be expressly given and cannot be implied simply because a banker-customer relationship exists. The court awarded the applicant ₦7.5 million in damages for the breach of her privacy rights.
Image Rights data as the new oil
The legal boundaries of commercial exploitation were clarified in the May 2026 judgment of Larry Nwabueze v. Nigerian Breweries Plc. The applicant attended a public event where his image was captured and used by the brewery in an advertising campaign without his consent. The Lagos High Court awarded ₦10 million in damages, ruling that an individual’s image constitutes personal data under the NDPA. The court established that mere presence at a public event does not amount to consent for commercial endorsement.
Data Accuracy and Economic Identity
In Bonje v. Guaranty Trust Bank Plc (2025), the applicant sued the bank after receiving conflicting and inaccurate statements of account. The Lagos High Court held that financial records are a form of personal data, and issuing misleading or altered records violates the principle of fairness under Section 24(1)(e) of the NDPA.
The court awarded ₦5 million in damages, explicitly holding that data protection rights are subsumed within Section 37 of the Constitution and can be enforced via fundamental rights procedures.
These rulings establish that commercial exploitation without a lawful basis attracts severe liability and substantial damages, signaling judicial recognition of the economic harm of misuse. However, they do not recognize a positive right to share in the profits derived from lawful processing.
Challenges of a Pay-for-Data Model data as the new oil
Proponents of data monetization argue that a property-like compensation model could promote fairness, incentivize better consent practices, and encourage local data ecosystems. Global experiments with data cooperatives, personal data marketplaces, and “pay-for-data” platforms illustrate possible pathways. Under the NDPA’s accountability and transparency principles, clearer disclosure of commercial value and optional monetization mechanisms could theoretically be developed without undermining privacy.
However, opponents caution that a general right to payment risks converting privacy into a commodity, potentially pressuring vulnerable individuals to sell sensitive data. Consent under the NDPA is intended to ensure voluntary participation; adding mandatory fees could complicate service provision, raise costs for users, and create enforcement difficulties across millions of data subjects. Many commercial uses rely on legitimate interests or contractual necessity rather than pure extraction. Implementation challenges include the valuation of individual data points, attribution in aggregated datasets, cross-border enforcement, and the risk of creating new intermediaries that capture value intended for individuals. Existing remedies which are usually damages, profit disgorgement ordered by the NDPC, and constitutional claims, offer more immediate protection than an untested royalty system.
CONCLUSION
Nigerian law currently answers the “pay-for-data” question in the negative: individuals are not entitled to payment merely because their personal data is used commercially under a lawful basis. The Nigerian legal framework treats personal data as a fundamental aspect of human autonomy rather than corporate inventory.
Rather than establishing a system where individuals receive small payouts for their digital footprints, Nigerian courts actively protect citizens by enforcing strict rules on consent, prohibiting unauthorized marketing, and issuing heavy financial penalties when companies breach those boundaries. Legislative or regulatory evolution could eventually explore limited monetization options, such as voluntary data markets or collective bargaining through data cooperatives, while preserving the primacy of privacy. Ultimately, if data is truly the new oil, Nigeria must decide whether its citizens remain mere sources of extraction or become stakeholders entitled to a fair share of the refined value. For now, the Constitution and the NDPA supply a protective foundation focused on remedying harm rather than mandating profit-sharing..
References data as the new oil
Bonje v. Guaranty Trust Bank Plc, Suit No. LD/18950MFHR/2024 (unreported, 2025).
Chukwunweike Akosa Araka v. Ecart Internet Services Nigeria Limited & Eat ‘N’ Go Limited (2025).
Constitution of the Federal Republic of Nigeria 1999 (as amended), Section 37.
Ejechi, Victor. “Data is the new oil, but who owns Nigeria’s data?” TheCable, 21 October 2025.
Folashade Molehin v. United Bank for Africa Plc (FHC/L/CS/2625/2023).
Incorporated Trustees of Digital Rights Lawyers Initiative & Ors v. National Identity Management Commission (2021) LPELR-55623(CA).
ICLG, Data Protection Laws and Regulations 2026 – Nigeria.
Larry Nwabueze v. Nigerian Breweries Plc (High Court of Lagos State).
National Data Protection Act (NDPA), 2023.
Nigeria Data Protection Commission, General Application and Implementation Directive 2025.
Nwakama, Precious. “Nigeria’s Data Is the New Oil – But Who Owns the Rig?” Vanguard, 16 July 2025.
“Data is the New Oil—But Are Nigerians Selling Theirs Too Cheap?” Techeconomy, 24 March 2025.
Data as the new oil, Data as the new oil,,Data as the new oil,,Data as the new oil,,Data as the new oil,
CONTRIBUTORS
LEAD PARTNER, EKO SOLICITORS AND ADVOCATES
Counsel EKO SOLICITORS AND ADVOCATES
AKERELE OLAOLUWAKIITAN OLUWAREMILEKUN
INTERN, EKO SOLICITORS AND ADVOCATES