Nigeria Data Protection Act and WhatsApp Contacts: What Small Businesses Need to Know

If you run a business on WhatsApp, you hold personal data every day: names, phone numbers, delivery addresses, order histories and sometimes photos. Nigerian law has rules about how that data must be handled. Many small businesses do not realise this applies to them, and a casual approach, such as sharing customer numbers in groups or buying contact lists, can create real risk. This guide explains the basics in plain language so you can adopt better habits.

What is the Nigeria Data Protection Act?

The Nigeria Data Protection Act 2023 (NDPA) is the main law governing how personal data is collected, used, stored and shared in Nigeria. It also established the Nigeria Data Protection Commission (NDPC), the regulator that oversees compliance. The law applies to organisations that process personal data, which can include small and informal businesses as well as large companies, depending on what they do and how much data they handle.

What counts as personal data?

Personal data is any information that can identify a person, directly or indirectly. In a WhatsApp business, that includes:

• Phone numbers and names.
• Email and delivery addresses.
• Photos and voice notes.
• Order history and payment details.
• Messages that include personal information.

Some data is more sensitive, such as health, religion or financial information, and needs extra care.

Key principles in plain language

Data protection laws, including Nigeria's, generally rest on a set of principles. In summary:

1. Lawful and fair use. You need a legitimate reason to collect and use data, such as consent, a contract with the person or a legal duty.
2. Clear purpose. Collect data for a specific, stated reason and do not use it for unrelated things.
3. Data minimisation. Collect only what you need. You do not need someone's home address to send a Status update.
4. Accuracy. Keep data correct and up to date.
5. Limited storage. Do not keep data longer than necessary.
6. Security. Protect data from loss, theft and misuse.
7. Accountability. Be able to show how you comply.

People also have rights, such as being informed about how their data is used, accessing it, correcting it and in some cases asking for deletion or objecting to marketing.

What this means for WhatsApp businesses

Collecting customer numbers

When customers message you, they expect you to use their number to reply and fulfil orders. Using that number for marketing broadcasts is a separate purpose, so tell people and get consent. A simple line in your profile or order form works: "By ordering, you agree we may send updates about your order and occasional offers. Reply STOP to opt out."

Marketing and consent

Send marketing only to people who agreed to receive it, and honour opt-outs promptly. This is also what WhatsApp expects. Read what is allowed on WhatsApp marketing.

Buying or scraping contact lists

Buying lists or scraping numbers from groups and websites is risky. The people on those lists did not agree to hear from you, which can breach both data protection principles and WhatsApp's rules.

Sharing numbers in groups and communities

Posting customer or member numbers in groups without permission can expose people to spam and scams. Contact exchange communities should tell members clearly how numbers are shared. For example, Status Connect explains in its privacy policy that numbers are shared only with approved members. If you share lists, ask for consent, explain who will see the numbers and let people withdraw.

Importing and storing contacts

When you import a VCF list, you are storing personal data. Keep files in safe places, avoid sharing them widely and delete copies you no longer need. See our guide to VCF files.

Screenshots and customer messages

Before posting a customer's chat or photo on Status, ask permission and hide identifying details.

Staff and devices

If employees access your WhatsApp Business account, limit access and remove it when they leave. Use two-step verification and secure phones.

A practical compliance checklist

1. Write a short privacy notice. Say what data you collect, why, who sees it and how to contact you. Place it on your website, profile or order form.
2. Get and record consent for marketing. A saved "Yes, send me offers" message is a basic record.
3. Offer easy opt-out and respect it.
4. Collect only what you need.
5. Secure devices and accounts. Screen locks, two-step verification and backups.
6. Limit sharing. Do not share customer data with others unless necessary and permitted.
7. Delete old data. Remove contacts and files you no longer need.
8. Know who is responsible. In a small business, that might be you. Larger operations may need a designated person.
9. Plan for incidents. If an account is hijacked or data is leaked, act quickly to contain it, inform affected people where appropriate and follow guidance from the regulator.
10. Check registration duties. Depending on the volume and nature of data you process, there may be registration or reporting requirements. Check with the NDPC or a lawyer.

Everyday scenarios and what to do

A customer asks you to delete their number

Treat the request seriously. Remove their contact from your phone, labels and any lists or spreadsheets, and reply politely to confirm. Keep only what you genuinely need to keep, such as a record of a past sale, and explain that if asked.

A friend asks for your customer list

Do not hand it over. Those people trusted you with their numbers for a specific purpose. Offer to introduce your friend or share a public business number instead.

You want to add customers to a promotion group

Ask first. Send a short message such as "Would you like to join our offers group? Reply YES." Adding people without asking can upset them and lead to reports against your account. Our comparison of WhatsApp groups and communities helps you pick the right format.

You lose your phone

A lost phone can expose every customer number on it. Lock or erase it remotely, secure your WhatsApp account and consider whether affected customers should be told. Backups help you recover, but they should also be protected.

Frequently asked questions

Does the law apply if I only have a few customers?

The Act applies according to how and why you process personal data, and the regulator may treat small and large operations differently. Even if you are small, following the basic principles is wise and costs nothing. For a definite answer, speak to a lawyer or the NDPC.

Is it illegal to save a number I got from a group?

Saving a number to chat with someone is not the main issue. The risk comes from what you do next, such as sending unwanted promotions, adding the person to groups or passing the number on. Use contacts for the reason you got them.

Do I need written consent, or is a WhatsApp reply enough?

A clear, recorded message where someone agrees to receive offers is a practical way to show consent. Keep a screenshot or note of it. Ask a lawyer if your business handles sensitive information or large volumes.

Can I keep customer data forever?

Only keep it as long as you need it for the purpose you collected it or for legitimate record keeping. Review your contact lists every few months and delete what you do not need.

Why this helps your business, not just compliance

Handling data responsibly builds trust. Customers are more willing to share their numbers, save yours and refer friends when they believe you will not misuse their details. Good practice also reduces the chance of complaints, bans and fraud. It fits naturally with growing a healthy WhatsApp network.

Where to get official information

• The Nigeria Data Protection Commission publishes guidance, notices and contact details.
• The Act itself and any regulations or guidance notes explain obligations in detail.
• A qualified lawyer can advise on how the law applies to your business.

Treat people's numbers the way you would want yours treated, and you will be on the right path.