October 14, 2026

THE RIGHT TO BE FORGOTTEN: THE IMPORTANT THING IS, CAN NIGERIANS DEMAND THE REMOVAL OF PERSONAL INFORMATION FROM THE INTERNET?

by Ekosolicitors

Introduction to right to be forgotten

A person applies for a new job several years after an embarrassing incident. The matter has long been resolved. There was no conviction, no continuing legal proceeding, and no ongoing dispute. Yet, whenever the person’s name is searched online, an old publication still appears among the first results. The person has moved on, but the internet has not. This raises a question that is becoming increasingly important in Nigeria’s digital society: Can an individual legally demand that personal information about them be removed from the internet? The answer is neither a yes nor a simple no.

Nigeria’s legal framework now recognises a data subject’s right to seek the erasure of personal data in certain circumstances. The Nigeria Data Protection Act 2023 (“NDPA”) expressly gives data subjects the right to request erasure and also provides circumstances in which a data controller is required to erase personal data. The Nigeria Data Protection Commission (NDPC) itself identifies this as the “right to be forgotten.” (National Debt Management Office)

However, the right must be understood alongside other competing interests, including freedom of expression, journalism, public interest, legal obligations and the legitimate need to retain certain information. The real legal question, therefore, is not simply whether a person wants something removed. It is whether the law requires or permits that information to be erased in the circumstances.

Privacy in the Digital Age right to be forgotten

The right to privacy is not a concept created by the internet. Section 37 of the Constitution of the Federal Republic of Nigeria 1999 (as amended) provides that: “The privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications is hereby guaranteed and protected.”

The constitutional protection of privacy provides an important foundation for the modern Nigerian data-protection regime. The NDPC itself identifies section 37 as part of the legal foundation for privacy protection in Nigeria. (National Debt Management Office)

The difficulty, however, is that information now exists in a form that was almost impossible to contemplate when the constitutional provision was drafted. Personal information can be copied, indexed, reposted, archived, searched, and reproduced across multiple platforms within seconds. A photograph posted years ago may resurface. An outdated professional profile may continue to appear in search results. A person’s old address, telephone number or other personal information may remain accessible long after the original reason for publication has disappeared. This is where data protection law becomes particularly significant.

What Does the Nigeria Data Protection Act Say?

The NDPA 2023 provides a comprehensive statutory framework for regulating the processing of personal data in Nigeria. One of its stated objectives is to safeguard the fundamental rights and freedoms of data subjects, regulate the processing of personal data and provide remedies where data-subject rights are breached. Section 1 expressly recognises privacy and the protection of data subjects as central objectives of the legislation. The Act applies broadly to the processing of personal data, including circumstances where the controller or processor operates in Nigeria, the processing takes place in Nigeria, or an entity outside Nigeria processes the personal data of a data subject in Nigeria. See section 2, NDPA 2023.

More importantly for this discussion, section 34 establishes a number of rights belonging to data subjects. These include the right to obtain information about how personal data is being processed, the right to obtain a copy of one’s personal data, the right to correction of inaccurate or outdated information, the right to erasure, and the right to restriction of processing in specified circumstances.

The Right to Erasure right to be forgotten

Section 34(1)(d) provides that a data subject has the right to obtain the erasure of personal data concerning the data subject without undue delay. Section 34(2) goes further. It provides that a data controller shall erase personal data without undue delay where:

the personal data is no longer necessary in relation to the purposes for which it was collected or processed; or
the data controller has no other lawful basis to retain the personal data.

This is the statutory foundation for what is commonly described as the “right to be forgotten.” It is important, however, to understand what the provision actually does. It does not mean that every Nigerian has an automatic right to demand that every reference to them on the internet be deleted simply because they no longer like it. The right operates within the structure of the NDPA and depends upon the circumstances surrounding the collection, processing, use and retention of the information.

Erasure Is Not the Same as Rewriting History

Consider two different situations. In the first, a company continues to retain a person’s personal information long after the purpose for which it was collected has ended and has no lawful basis for continuing to process it. In the second, a newspaper has lawfully published an article concerning a matter of genuine public interest, and the person involved later decides that the article is embarrassing.

These situations cannot automatically be treated alike. The first may present a straightforward data-protection question concerning whether continued retention is necessary or lawful. The second raises a much more difficult question involving privacy, freedom of expression, journalism and the public’s right to receive information. This distinction is essential because the right to be forgotten is not a general right to erase uncomfortable facts from public consciousness.

The Importance of Accuracy right to be forgotten

The NDPA also recognises a related but distinct right concerning inaccurate, outdated, incomplete or misleading personal data. Under section 34(1)(c), a data subject may seek correction of such information or, where correction is not feasible or suitable, deletion of the relevant personal data.

This distinction matters. Suppose an online profile states that an individual holds a qualification that they never obtained. That is fundamentally different from a truthful report of something that actually happened years ago. In the first situation, the central issue may be accuracy.

In the second, the question may be whether the continued processing or accessibility of accurate information remains necessary or lawful. The law therefore provides more than one mechanism through which a person may challenge the continued processing of information about them.

What About Social Media?

Social media creates an especially complicated dimension. A person may upload a photograph voluntarily, only for it to be copied by another account. A former employer may publish information about an employee. A business may retain customer information. A website may publish an individual’s name as part of an article. A third party may then reproduce the information elsewhere. Removing the information from one location may therefore not automatically remove it from the entire internet.

This is one reason why the language of the NDPA is important. The legal obligation generally attaches to the processing of personal data by a data controller or processor. The practical question may consequently involve identifying who is processing the information, for what purpose, on what lawful basis, and whether the relevant statutory conditions for erasure have been satisfied. The NDPC’s current Data Subject Access Request process expressly allows individuals to request erasure, rectification, restriction of processing and other data-subject rights.

The Public Interest Exception

One of the most important limitations is the public interest. Section 3(2) of the NDPA recognises circumstances in which certain obligations under Part V do not apply to processing carried out, among other things, for publication in the public interest, journalism, educational, artistic and literary purposes, to the extent that the relevant obligations and rights are incompatible with those purposes. The provision also addresses processing connected with criminal investigations, national security and legal claims.

This means that a request to erase information cannot be considered in isolation from the purpose for which the information is being processed. For example, a person cannot simply argue that an accurate newspaper report should disappear because it is embarrassing. The legal analysis would have to consider whether the processing falls within an applicable exemption and whether the competing legal interests justify continued publication or processing. The NDPA therefore does not establish a system in which privacy automatically defeats freedom of expression. Instead, it creates a framework in which competing interests must be considered within the statutory scheme.

The European Experience: Google Spain

Nigeria is not the first jurisdiction to confront the tension between privacy and information that remains permanently accessible online. A leading comparative authority is Google Spain SL, Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González (Case C-131/12), decided by the Court of Justice of the European Union in 2014.

The case arose after a Spanish individual’s name continued to produce search results linking him to an old newspaper publication concerning debt-recovery proceedings. He sought removal of the information from Google’s search results. The Court recognised that, in certain circumstances, an individual could require a search engine to remove links to information concerning that person where the information was inadequate, irrelevant, no longer relevant or excessive in relation to the purposes of processing.

The significance of Google Spain is not that Nigeria is automatically bound by the decision. It is not. Its significance is that it demonstrates the legal problem created when information may remain technically accessible forever even though its relevance to an individual’s present circumstances has diminished. It also demonstrates why the “right to be forgotten” cannot sensibly be treated as an absolute right.

Does Nigeria Have a Full “Right to Be Forgotten”?

The more precise answer is that Nigeria has a statutory right to erasure which the NDPC recognises as the right to be forgotten, but that right is conditional rather than absolute. The NDPA provides a legal basis for individuals to seek erasure in specified circumstances. It also recognises rights to rectification, objection and restriction of processing. At the same time, the legislation recognises circumstances in which information may legitimately continue to be processed. Consequently, the mere fact that information is old, embarrassing or inconvenient will not, by itself, necessarily establish a right to have it removed. The stronger question is: Is there a continuing lawful and necessary basis for processing the information?

What Can an Individual Do? right to be forgotten

Where a person believes that their personal data is being unlawfully or unnecessarily processed, the NDPA provides several possible avenues. The first step may be to identify the relevant data controller or processor and make a request exercising the appropriate data-subject right.

Depending on the circumstances, that request may concern:

access to personal data;
correction of inaccurate or misleading information;
erasure of personal data;
restriction of processing; or
objection to processing.

The NDPC currently provides a Data Subject Access Request mechanism through which individuals can exercise relevant rights, including requests for erasure and rectification. (NDPC Forms)

Where a dispute remains unresolved, the NDPA provides a regulatory framework through which complaints may be brought before the Commission. The Commission’s functions expressly include receiving complaints relating to violations of the Act. See section 5(g), NDPA 2023.The Act also contains enforcement and remedies provisions, including compliance orders, enforcement orders, judicial review and civil remedies under sections 46–51.

The Bigger Question: Should the Internet Remember Everything? right to be forgotten

The legal debate ultimately raises a question that extends beyond data protection. There is value in preserving information. Historical records matter. Journalism matters. Public accountability matters. Court records matter. Legitimate commercial and regulatory records may need to be retained. However, there is also a legitimate interest in ensuring that individuals are not permanently defined by information that is inaccurate, unlawfully processed, no longer necessary, or disconnected from the purpose for which it was originally collected. The law therefore has to navigate between two competing dangers.

On one side is a world in which personal information remains available indefinitely, regardless of whether there is a continuing lawful justification for retaining or processing it. On the other is a world in which individuals can use privacy rights to suppress legitimate information merely because they find it uncomfortable. The answer lies neither in unlimited deletion nor unlimited retention. It lies in lawful, proportionate and context-sensitive processing of personal information.

conclusion right to be forgotten

the internet has changed the meaning of permanence. In the offline world, an embarrassing event might eventually fade from public memory. Online, however, an old photograph, publication or piece of personal information can remain searchable for years and potentially be reproduced indefinitely. Nigeria’s legal framework has begun to address this reality, but being forgotten is not the same as having history rewritten.

The real protection offered by the law is more nuanced: where personal data is no longer necessary, inaccurately maintained, or lacks a lawful basis for continued retention, an individual may have a legitimate legal route to seek its correction, restriction or erasure. The challenge for Nigerian data-protection law will increasingly be determining where legitimate privacy ends and legitimate public interest begins. In an age where information can outlive the circumstances that created it, that boundary may become one of the most important questions in modern privacy law.

References

Constitution of the Federal Republic of Nigeria 1999 (as amended), s 37.

Nigeria Data Protection Act 2023, ss 1–3, 24–25, 34–36, 46–51.

Google Spain SL and Google Inc v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González (Case C-131/12) EU:C:2014:317.

Nigeria Data Protection Commission, Data Subject Access Request Form.

Nigeria Data Protection Commission, NDPC Journal, Volume 1 (2026).

Court of Justice of the European Union, Right to be forgotten on the Internet: Google Spain SL and Google Inc v AEPD and Mario Costeja González (2014).

CONTRIBUTORS