Every Monday morning, a sales manager at a Lagos real estate company forwards a spreadsheet to her team. It’s titled “Lekki HNI contacts 2026 (bought)”. It has 8,000 names, phone numbers and email addresses, and nobody on it has ever heard of the company.
By Tuesday, the whole list has received a WhatsApp broadcast about a “luxury 4-bedroom terrace with BQ, off-plan, flexible payment”.
It’s ordinary Nigerian marketing. It’s also illegal.
The law most Nigerian marketing breaks every day is the Nigeria Data Protection Act 2023, and its enforcement teeth are sharper than most owners have priced in.
Bought contact lists blasted on WhatsApp, pre-ticked “subscribe” boxes, tracking pixels that fire before anyone consents, and customers who asked to stop receiving messages and kept receiving them all sit on the wrong side of the statute. Its penalties run to ₦10 million or 2% of annual gross revenue, whichever is higher. The regulator has already shown it will use them, with the Nigeria Data Protection Commission levying a ₦766 million penalty against one Nigerian company in 2025.
This is the practical guide to marketing legally. Conveniently, the compliant version of your marketing also performs better.
Five Rules That Cover Most Marketing
- Consent must be real. The NDPA’s standard for marketing consent is that it’s freely given, specific, informed and unambiguous. A person must actively choose to hear from you, knowing what they’re choosing. Pre-ticked boxes don’t count, “by using this site you agree” fails, and marketing consent bundled into terms nobody reads fails too. A clear, unticked checkbox (“Send me offers and updates on WhatsApp and email”) passes, and it takes thirty seconds to add.
- Bought lists are radioactive. Buying contact databases and messaging them breaks the rules unless each person specifically agreed to be contacted by you, which, for a bought list, they almost never did. It’s also commercially self-defeating. As the email guide covers, cold lists poison the sender reputation your real messages depend on, and on WhatsApp they get your number reported and blocked. The law and the algorithm agree on this one. I’d treat a bought list the way I’d treat an unattended bag at the airport.
- Keep the receipt. Compliance is largely about evidence. For every marketing contact, you should be able to show when consent was given, where (which form, page or counter), and for what scope (email, WhatsApp or SMS). A consent record with timestamp, source and scope, stored against the contact in your CRM, turns an accusation into a two-minute lookup. Without it, even a properly consented list is indefensible.
- Stopping must work, instantly. People have an explicit right to object to direct marketing, and you must honour it. Every email needs a working unsubscribe, every WhatsApp and SMS programme needs an honoured opt-out (“Reply STOP”), and the request must actually stop the messages across all your lists. A customer who opts out and keeps getting messages is a complaint to the NDPC waiting for a bad day.
- Tracking needs consent too. Non-essential cookies and tracking scripts, like the pixels behind your ads and analytics, follow the same consent logic. The banner and the tags must actually talk to each other, so when a visitor declines, the non-essential tags stay off. It overlaps with the measurement rebuild every business needs anyway. Consent-compliant, first-party tracking is the same project as accurate tracking, done once and done properly.
In Jurassic Park, Jeff Goldblum’s mathematician warns that the scientists were so busy asking whether they could that they never asked whether they should. A bought list of 8,000 Lekki numbers is the marketing version.
Obligations That Grow With You
Businesses processing personal data at meaningful volume carry extra duties under the Act. Depending on thresholds, these include registering with the NDPC as a data controller of major importance, annual audit filings through licensed professionals, breach notification within tight windows, and data processing agreements with every vendor that touches your customer data. That includes your email platform, your CRM and your agency, us included, which is why a DPA is part of our standard paperwork.
The details are exactly where a qualified Nigerian data protection professional earns their fee, and this article is general information, not legal advice. The strategic point stands either way. These obligations cost far less to build into your marketing now than to retrofit during an NDPC enquiry.
Every rule above makes your marketing better as well as legal. Consented lists open, click and convert far better than cold ones. Honoured opt-outs protect deliverability. Consent records force the CRM discipline you needed anyway. Compliance is a forced upgrade to Nigerian marketing, and a moat, because competitors running on bought lists and silent pixels are building liabilities while you build an asset.
The One-Afternoon Compliance Sprint
For a typical Nigerian SME, the distance from non-compliant to defensibly compliant is shorter than people fear. One focused afternoon covers most of the daily exposure.
- Add clear, unticked consent wording to every form and opt-in point, including your website, checkout, WhatsApp onboarding and the paper forms at the counter.
- Switch your email platform to double opt-in.
- Test that unsubscribe and STOP handling actually work from end to end.
- Start recording the consent source and timestamp for every new contact.
- Quarantine any list segment whose consent you can’t prove, and win it back properly with a one-time re-permission message. Pretending won’t hold up.
Then book a professional review for the structural items, like registration status, audit obligations, vendor DPAs and a breach plan. The afternoon handles the daily exposure, and the professional handles the framework.
Book the Afternoon
Block out one afternoon this month. List where every contact on your marketing lists came from, check that your website asks before it tracks, and test that an opt-out actually works. Then book the professional review for whatever you find.
Some moats you have to dig yourself. This one, the law dug for you.
Delete the Spreadsheet
The real estate company’s broadcast got two enquiries and forty-one blocks. The spreadsheet still gets forwarded every Monday, and every forward adds another page to a file the NDPC would love to read.
Compliance gaps tend to hide in Retain and Measure. The free 2-minute diagnostic will show you which wall needs attention first.
P.S. Businesses spending ₦1M or more a month on marketing also qualify for a free Leak Check. It’s a 30-minute call, and you choose whether we stay in touch afterwards.
The real estate example is illustrative. Based on the Nigeria Data Protection Act 2023 and NDPC enforcement reporting current as of mid-2026, including the widely reported 2025 penalty referenced above. Thresholds, registration categories and audit requirements depend on your specific processing activities. This article is general information and emphatically not legal advice. Engage a qualified Nigerian data protection professional for your specific obligations.
This article covers one part of a bigger system. Our guide to digital marketing in Nigeria shows how the four walls fit together, and the order to build them in.
