Personal data has emerged as one of the most valuable assets, driving innovation, decision-making, and business growth. Its value transcends industries, propelling targeted marketing, personalised services, and data-driven strategies. However, as its importance has grown, so too has the vigilance of individuals determined to protect their personal information from misuse or unwarranted exploitation. The Nigeria Data Protection Act, 2023 (NDPA) has significantly strengthened this resolve by codifying the rights of data subjects and imposing stricter obligations on organisations that process personal data, either as data controllers or processors.
One of the protected privacy rights under the NDPA is the right to request and secure the erasure of personal data without undue delay, otherwise known as the right to erasure or the right to be forgotten. In the case of Tokunbo Olatokun v Polaris Bank Limited, [1] decided by the Honourable Justice Y. A. Adesanya of the High Court of Lagos State on 5 December 2024, the Court described the right to privacy as the right to be left alone. The case highlights the increasing readiness of individuals to assert their rights under the NDPA and to hold organisations accountable to their obligations under the law.
This article examines the legal and practical implications of the recent decision of the court, analysing the interplay between data subjects' rights under the NDPA and the responsibilities of data controllers to honour those rights. It further explores the implications of the decision for businesses navigating the evolving regulatory environment and offers insights into the proactive measures required to comply with data protection laws in Nigeria.
--
Read the full publication at ALN Nigeria | Aluko & Oyebode
