Most transactional relationships require a written document clearly spelling out the dos and dons’ that apply to the transaction. The existence of such documents ordinarily should set the benchmark of expectations, and all parties ought to be held accountable to the terms and confined to the conditions. However, unlike the general law of contract, in data privacy, a Privacy Notice has a different approach and title different from a contract, it is what it is, “a Notice”. Every company needs to buy and win over the trust of its consumers/clients, especially when dealing with data/personal information there is a need to build a sense of “I got you and your information is kept tight” and one-way companies achieve this is through their Privacy Notice.

Beyond building trust, Privacy Notice is a mandatory requirement in fulfillment of the core principle of “accountability and transparency”. The central consideration of the principle of transparency is that the data subject should be able to determine in advance what the scope and consequences of the processing entails so as to avoid surprises at a later point about the ways in which their personal data has been processed. To achieve this, Section 27(1) of the Nigeria Data Protection Act (NDPA), mandates data controllers to inform data subjects of their identity and contact information, legal basis and purpose of processing, data recipients, data subject rights, retention period, right to complain; and if there will be any automated decision-making. It is equally statutorily required that the information must be presented in a clear, concise, transparent, and easily understandable format, tailored to suit the type of individuals whose data is being processed and the type of processing. From the required content, the primary purpose of a Privacy Notice is simple: to inform individuals in a clear and relatable format about how their personal data is being handled. While organizations may publish Privacy Notice for different reasons, whether to fulfill regulatory requirements or to demonstrate ethical responsibility, the underlying goal remains the same: to keep data subjects fully informed.

Despite the vital use of a Privacy Notice, it is not without legal limitations in terms of enforceability. Let us put this in proper context with the following scenario: imagine that a Data Subject (DS) bought a private movie ticket online, to complete the process, the DS is required to provide full name, bank details, email address and identity card just for the purpose of making payment and ensuring that the slot is reserved and used by the DS. By the privacy notice, the Data Controller (DC) informs the DS that the purpose is strictly limited to processing payment; confirming identity on the day and other processing deemed fit. The privacy notice also provides that any information relating to comments on the DC and movie preferences/likes of the DS is de-identified and processed solely to improve their services. Also, the privacy notice states the DS’s rights, and that financial information is not retained beyond 24hours after purchase. In respect of security measure, the privacy notice specifies its cloud service provider and states as follows: We use industry-standard encryption, multi-factor authentication (MFA), and role-based access control to ensure the confidentiality and integrity of user data. However, in June 2025, the DS received alerts for new movies available in the private cinema and finds out that the financial information was also used to verify anti-money laundering incidence. Also, due to the change of the cloud service provider, the DC suffered a data breach arising from a misconfigured cloud storage bucket hosted on a new cloud service provider’s platform. The bucket, which stored backup data including customer transaction logs and partial identity data (e.g., names, phone numbers, BVNs), was accidentally left publicly accessible beyond a day. This vulnerability bypassed the company’s stated technical measures, including encryption and access controls, because the cloud configuration was not properly secured or audited by their DevOps team. As a result, the DS seeks to transfer his information, including movie preferences and financial information to a new company but the request was refused.

Now, can the DS/DC rely on the Privacy Notice as a legally enforceable document to sue or defend a suit for the further use of data, change of cloud service provider without consent, failure of the technical measure and refusal of the right of data portability?

The first identified legal limitation is that a Privacy Notice is not a contract, but a statement which demonstrates the DC’s data protection practices; hence its terms can be unilaterally changed by the DC to the extent accepted under the law – the NDPA. This implies that our DC can change its cloud service provider and can upgrade its technical measure as long as it provides data integrity and security as provided under Section 39(1)¹ of the NDPA. However, under the transparency and accountability principle the DC still has an obligation to update its Privacy Notice before implementation of that upgrade.

Secondly, a Privacy Notice ‘is not in itself binding’ but enforceable only to the extent of its compliance with the law, the NDPA or the extent to which violation of the Notice will lead to data breach. This implies that the DC (in our scenario) might rely on the Privacy Notice, particularly in view of the provision of Section 38(2)(a)² and 38(1)(c) of the NDPA to restrict the DS’s right to data portability on grounds of the de-identification and retention period, which can be relied upon to proof technical restriction. This does not relieve the DC entirely, as the DS still has a joker card “breach of security” and “breach of the principle of purpose limitation”³ provided under Section 24 of the NDPA. We can imagine the promptness of a DC to raise a defense that the privacy notice includes the omnibus clause “other processing deemed fit”; which should cover it. However, this clause cannot in itself be relied upon for several reasons, one of which is that the clause violates the provisions of the NDPA that requires purpose of data processing to be stated in specific, clear and explicit term. Also, the clause does not establish/satisfy the compatibility test under section 24(4) of the NDPA.

Thirdly, Privacy Notice is only a valid shield for a DC when its provisions/clauses are clear, specific, explicit and lawful. It is important to state that omnibus clauses should not be a DC’s go to in a Privacy Notice or policy, omnibus clauses have no saving powers, they leave room for violation and are in clear breach of the law.

Ultimately, while a Privacy Notice does not itself constitute a binding contract, its enforceability is dependent on the facts of each case, so its significance in legal proceedings should not be understated. Violations of the terms outlined within a Privacy Notice—particularly those resulting in data breaches or the misuse of personal information—can provide substantial grounds for legal action against a data controller. In court, the Privacy Notice serves as a crucial piece of evidence, offering a benchmark against which the company’s data protection practices and representations are evaluated. Its contents may be scrutinized to determine whether the controller’s conduct aligns with the stated commitments, thereby influencing both liability and the measure of damages, as well as the reputational consequences for the organization.

1. Section 39(1) of NDPA provides that a data controller and data processor shall implement appropriate technical and organisational measures to ensure the security, integrity and confidentiality of personal data in its possession or under its control, including protections against accidental or unlawful destruction, loss, misuse, alteration, unauthorised disclosure, or access.
2. This provision allows a data controller to implement technical measures which includes pseudonymisation or other methods of de-identification of personal data. Once a data controller de-identifies an information, it can be argued that it is technically impossible to grant the right to data portability as provided under section 38(1)(c) of the NDPA.
3. One core principle of data privacy is purpose limitation which requires that data is processed to specific, explicit and legitimate purpose. Where a notice contains omnibus phrases like “other processing as deemed fit”, it is clear that this offends the rule of being explicit and specific, any processing done under that omnibus heading ought not to pass the principle of purpose limitation. Section 24(1)(c) provides as follows: “collected for specified, explicit, and legitimate purposes, and not to be further processed in a way incompatible with these purposes”