NDPA 2023 email marketing: what Nigeria’s data law says about consent and opting out

NDPA 2023 email marketing comes down to one rule in the Commission’s 2025 directive: consent is required for any direct marketing activity. The Nigeria Data Protection Act 2023 itself does not use the word email in the parts we read. It gives people a right to withdraw consent and a right to object to direct marketing. This is general information, not legal advice, and we read the Act and the directive on 5 October 2026, from files published on ndpc.gov.ng.

We use only that site. We did not read law-firm commentary, other regulators or any Nigerian communications rules, and we say below where the texts are silent. The point is to help a business owner see what the sources say about marketing email, not to certify any footer as compliant.

What the NDPA 2023 email marketing sources are

The NDPC’s resources page lists the Nigeria Data Protection Act, 2023 and the NDP Act General Application and Implementation Directive (GAID) 2025, whose file name ends “March 20th”. The Act’s PDF is the Gazette copy: Official Gazette No. 119, Lagos, 1 July 2023, with the President’s assent shown as 12 June 2023. We did not check whether any section has been amended since.

The GAID’s own stated authority includes section 37 of the 1999 Constitution and sections 1(a), 6(c), 61 and 62 of the Act. Treat it as the Commission’s directive, which sits under the Act, and check the NDPC site for later versions.

Does NDPA 2023 email marketing fall under the Act at all?

Yes, in the way any personal data is covered. Section 65 defines personal data as information relating to an individual who can be identified, directly or indirectly, by an identifier such as a name or an online identifier. An email address that contains a person’s name looks like such an identifier to us, though the Act does not give email addresses as an example. Section 2(2) says the Act applies where the controller or processor is domiciled in, resident in or operating in Nigeria, where processing happens in Nigeria, or where a controller outside Nigeria processes the data of a person in Nigeria.

Section 3(1) excludes processing by a person solely for personal or household purposes. A company sending campaigns is outside that. We read a business address such as ada.obi@company.example as personal data about Ada. A shared mailbox such as info@company.example is less clear, and the texts do not say.

NDPA 2023 email marketing: consent comes first

Article 18(1)(a) of the GAID lists direct marketing first among the activities for which consent is required. Section 25(1) of the Act sets out the lawful bases for processing: consent, contract, legal obligation, vital interests, public interest and legitimate interests. We read that as the Commission expecting consent for direct marketing, not legitimate interest, though the directive does not say so in those words. Article 17(6) says a controller relying on consent must keep a proper record of it.

Section 26 sets the quality of consent:

• The controller bears the burden of proof (26(1)).
• Silence or inactivity is not consent (26(3)).
• The person must be told of the right to withdraw before consenting (26(4)).
• The request must be in clear and simple language (26(6)).
• Consent must be affirmative and not based on a pre-selected confirmation, and may be given in writing, orally or by electronic means (26(7)).

GAID Article 17(9) adds that where consent is required, the person must have a clear and explicit option to accept or decline. In practice that rules out a pre-ticked box on a signup form. How it applies to an existing customer list is a question for a lawyer, because the texts we read do not describe a soft opt-in for customers.

Opting out under NDPA 2023 email marketing rules

Two sections matter for the footer of a campaign. Section 35(1) gives the right to withdraw consent at any time, and 35(2) says the controller must make withdrawal as easy as giving consent. Section 36(3) says that where data is processed for direct marketing, the person may object at any time, and 36(4) says that once they object, the data may no longer be processed for that purpose.

We found no sentence in either text that says “include an unsubscribe link”. The duties are stated as rights and as ease of withdrawal. An unsubscribe link or a reply-to-stop line is a common way to meet “as easy as giving it”, but that is our reading. The 2025 directive’s Article 17(7)(b) repeats the withdrawal point.

Section 27 adds a notice duty. Before collecting personal data directly from a person, the controller must tell them its identity and contact, the lawful basis and purposes, recipients, retention, their rights, and the right to complain to the Commission. Section 27(3) says this goes in a privacy policy in clear, easily accessible form. A signup form is the natural place to link to it.

A footer for NDPA 2023 email marketing messages

This is our own draft wording, not tested legal text, using a made-up company:

You are receiving this because you asked to hear from Eko Bridge Logistics Limited. To stop marketing email at any time, reply STOP or write to privacy@ekobridge.example. How we handle personal data: https://ekobridge.example/privacy

It names the sender, gives an easy way to withdraw and links to a policy. It says nothing about proving consent, which lives in your records. Here is the made-up staff signature that goes with it, with a plain privacy link rather than a promotional line:

Example only. The company, numbers and person are made up. A privacy link is optional, not a stated requirement.

For the +234 formatting and the RC number question, see our business email signature Nigeria article. The CAC side is in CAC business letter requirements.

Penalties and registration for NDPA 2023 email marketing

Section 48 lets the Commission order a remedy, compensation or a penalty. For a controller or processor of major importance, the penalty may be up to the greater of 10,000,000 naira or 2 percent of annual gross revenue in the preceding financial year. For others it is the greater of 2,000,000 naira or 2 percent. Section 48(6) lists factors including the nature, gravity and duration of the breach and the number of people affected.

Section 5(d) gives the Commission the function of registering controllers and processors of major importance, and the NDPC’s home page lists a Guidance Notice on Registration (2024). Whether a given business falls into that class is decided by criteria in the directive and the Commission’s notices, which we did not apply to any business. The directive’s Article 18(2) says a compliance audit return must state whether a controller relies on consent for the activities in Article 18(1).

What the NDPA 2023 email marketing texts do not tell us

• Definition. Neither the Act nor the GAID text we read defines direct marketing. Whether a newsletter, a product update or a banner in a signature counts is unanswered.
• Existing customers. We found no exemption for customers or for business-to-business email.
• Tracking. Article 19 covers cookies and other tracking tools. We did not find it addressed to email open tracking.
• Other laws. We did not read communications-sector rules. A separate regulator may have its own.
• Signatures. Nothing we read mentions email signatures, disclaimers or footers.

Using the sources for your own checklist

A cautious team treating NDPA 2023 email marketing as consent-based would keep a dated consent record per address, link the privacy policy at signup, and test the opt-out path before each campaign. Put the unsubscribe handling in your email marketing tool, because a personal signature cannot honour a request. Wording for other places is in our guides to the GDPR email disclaimer and POPIA and email.

A tool such as emailfooter can keep the company line and privacy link identical across staff. Employees install their own signatures by following steps, and nothing is pushed into mailboxes. It is English only for now.

Frequently asked questions

Does NDPA 2023 email marketing require consent?

The NDPC’s GAID 2025 says consent is required for any direct marketing activity (Article 18(1)(a)). The Act itself requires lawful basis under section 25, and neither text defines direct marketing.

Is there an NDPA 2023 email marketing unsubscribe rule?

We found no sentence ordering an unsubscribe link. Section 35(2) says withdrawing consent must be as easy as giving it, and section 36 gives a right to object to direct marketing.

What does NDPC email consent have to look like?

Section 26 says it must be affirmative and not pre-selected, in clear and simple language. Silence is not consent, and the controller must be able to prove it.

Does the NDPA apply to a business email address?

An address that identifies a person, such as one with their name, is likely to be personal data under the Act’s definition. The texts do not discuss role addresses like info@.

What is the penalty under NDPA 2023 email marketing breaches?

Section 48 caps penalties at the greater of 10,000,000 naira and 2 percent of annual gross revenue for major-importance controllers, and 2,000,000 naira and 2 percent for others.