Consent and compliance for business messaging in Nigeria

Two separate sets of rules apply

Business SMS in Nigeria sits under two regimes at once. The Nigeria Data Protection Act 2023, administered by the Nigeria Data Protection Commission, governs how you collect and handle the phone numbers. The Nigerian Communications Commission's Do Not Disturb framework governs whether the networks will carry unsolicited marketing to a given subscriber.

They are independent. Satisfying one does not satisfy the other: a perfectly lawful marketing list will still be blocked for DND-active recipients, and a message that gets through DND can still be a data protection failure if the number was scraped.

What the NDPA means for a contact list

A phone number is personal data

It identifies a living individual, so collecting, storing and using it is processing under the Act, with all that follows.

You need a lawful basis

Consent is one basis. Performance of a contract - sending a receipt for something the customer bought - is another. Legitimate interest can apply but has to be reasoned and documented, not assumed. Marketing to strangers rests on consent in practice.

Purpose limitation

A number collected to deliver an order is not automatically available for a marketing campaign. If you want it for marketing, ask for that at the point of collection.

You are the controller; Sendozi is a processor

You decide who is messaged and why. Sendozi processes the list on your instruction to deliver the messages. The obligations to your recipients sit with you.

Data subject rights

People can ask what you hold, ask for it to be corrected, and object to marketing. Build a route for those requests before you need one.

Retention

Keep numbers for as long as the purpose requires, then stop. An indefinitely growing list of numbers nobody can account for is a liability rather than an asset.

The Nigeria Data Protection Commission is the authority here: it publishes the Act, its implementation guidance and the registration requirements that apply to data controllers. Check the current position with them, or with a Nigerian practitioner, before relying on any summary - including this one.

What good consent looks like

• Specific. 'Send me offers from Acme by SMS' rather than a blanket agreement buried in terms.
• Affirmative. An unticked box the person ticks, not a pre-ticked one they fail to notice.
• Unbundled. Not a condition of buying something they were buying anyway.
• Recorded. Store what they agreed to, when, and through which form or channel.
• Revocable. Withdrawal must be as easy as giving it was.

Opt-out, and how it works on Sendozi

Every promotional programme needs a working way out. The complication in SMS is that an alphanumeric sender ID is one-way: recipients cannot text back to it, and Sendozi does not receive inbound SMS, so a "Reply STOP" instruction would be a promise you cannot keep.

1. 1

   Publish a route you actually monitor

   A phone number, an email address or a short link to an unsubscribe page. Put it in the message.

2. 2

   Record the opt-out on the suppression list

   Sendozi checks suppression on every send, so a recipient added once is excluded from everything afterwards.

3. 3

   Apply it across programmes, not just the campaign it came from

   Someone who opts out of marketing has opted out of marketing, not of one particular blast.

4. 4

   Keep the record

   When they asked, through which route, and when it took effect. That record is your evidence if the request is later disputed.

The DND register

Separately from data protection, Nigerian subscribers can activate Do Not Disturb with their network to block unsolicited marketing. Once active, the network filters promotional traffic before it reaches the handset. Transactional messages travel a corporate route that is not treated as marketing. The DND guide covers the mechanics; the compliance point is simply that DND is not optional and cannot be bypassed.

Records worth keeping

Sendozi keeps the last three for you: message content, per-recipient delivery status with its timeline, and the account that sent it, all exportable. The first three are yours to keep, because they live at the point where you collected the number.

A practical checklist

1. Write down the lawful basis for each messaging programme you run. If you cannot, that is the finding.
2. Check that your collection form asks for marketing separately from the transaction.
3. Give every promotional message a working opt-out route and honour it across all programmes.
4. Classify each message honestly as transactional or promotional and route it accordingly.
5. Publish a privacy notice that says what you collect, why, how long for and who processes it.
6. Know your obligations as a data controller under the NDPA, including whether you must register with the NDPC.
7. Delete numbers you no longer have a reason to hold.
8. Review this annually, and whenever a new programme starts.