Your phone number on a forum. Your home address in a leaked spreadsheet. An old record that keeps following you. Many people assume nothing can be done about personal data once it is online. That is not quite true. The right to be forgotten in Nigeria has a legal footing in the Nigeria Data Protection Act 2023, and the courts have started to apply it. Here is what the law says, how it is enforced, and where its limits are.
Does the right to be forgotten exist in Nigeria?
Yes, in a specific form. Section 34 of the Nigeria Data Protection Act 2023 lists the rights of a data subject. Section 34(1)(d) gives you the right to obtain “the erasure of personal data concerning the data subject, without undue delay”.
Section 34(2) then sets out when a data controller must erase it. That includes where the data is no longer necessary for the purpose it was collected for, or where the controller has no other lawful basis to keep it.
In plain terms, if a company or organisation holds your personal data without a good reason to keep it, you can ask for it to be deleted. The same section also gives you rights to see what is held about you and to have inaccurate data corrected.
A Lagos court has already applied it
This is not just theory. In Olatokun v Polaris Bank Ltd, decided on 5 December 2024, the High Court of Lagos State affirmed the right to erasure under the NDPA. Afriwise’s review of the case notes that Justice Y. A. Adesanya described privacy as “the right to be left alone”.
Enforcement is growing too. In January 2026, BusinessDay reported that the Nigeria Data Protection Commission had concluded 246 investigations and issued 11 enforcement actions. Those included a N766.2 million fine on MultiChoice Nigeria in 2025 and a N555.8 million penalty on Fidelity Bank in 2024.
The message to organisations is clear: personal data is not theirs to keep forever.
For individuals, that shift is useful. A request that cites the NDPA now lands on desks where compliance teams know the regulator is watching.
What the NDPA does not cover
It helps to be realistic. The NDPA is about how organisations process personal data. It is a strong tool for data held by companies, apps, employers and service providers.
It is less straightforward for content published by individuals, or for news reporting that is accurate and in the public interest. The right to erasure is not a tool for removing true journalism, and nobody should promise otherwise.
Where it shines is with information that is:
- private, such as phone numbers, addresses and ID details
- outdated, and no longer serving its original purpose
- held or shared without a lawful basis
A practical tip: when you write to an organisation asking for erasure, be specific. Name the data, say where you found it, explain why it is no longer needed or was never lawfully held, and keep a dated copy of your request. Vague complaints are easy to ignore. Precise, well-documented requests are much harder to brush aside, and they give you a clear record if you need to escalate later.
Removing personal data from search results
Law and search engines work side by side. Google’s “Results about you” tool lets people request removal of results showing their phone number, email or home address. In February 2026, Google expanded it to cover government ID numbers, starting in the US with more regions planned.
Removing a result from Google does not delete the page itself, so the strongest outcome usually combines both routes: the source and the search result. Repudia’s personal data removal service focuses on exactly that, quietly and thoroughly.
Conclusion
The right to be forgotten in Nigeria is real. The NDPA gives you the right to erasure, a Lagos court has upheld it, and the NDPC is enforcing data protection with growing confidence. It works best for private, outdated or unlawfully held data. If your personal information is exposed online, talk to us. Your first consultation is complimentary and completely confidential.
