Only 12.3 per cent of advertising agencies in Nigeria comply with the Nigeria Data Protection Act 2023, raising concerns about how communications professionals handle personal information in digital marketing campaigns.
Franklyn Ginger-Eke, founder and chief strategist of The Rainbow Strategy (TRS), a licensed Data Protection Compliance Organisation, disclosed this at the 11th Nigeria Digital PR Summit in Lagos, where he urged public relations agencies, advertisers and content creators to make privacy consent a central part of their digital strategies.
Ginger-Eke, who spoke during a session titled “Consent Is the New Currency: The Data Trust Playbook for Digital PR and the Creator Economy” on Friday, October 16, said the growing use of audience data for targeted advertising, influencer campaigns and digital engagement had increased the need for compliance with data protection requirements.
He cited a September 2026 statement by the Nigeria Data Protection Commission (NDPC), which reportedly identified the communications industry as a major compliance gap, with advertising agencies recording a low compliance rate.
According to him, digital public relations increasingly relies on personal information collected through social media analytics, audience segmentation, retargeting, engagement monitoring and influencer performance tracking, making data protection a critical consideration for practitioners.
“Digital PR now runs on audience intelligence: follower data, engagement signals, segmentation, retargeting, social listening and influencer analytics. Every one of these is personal data processing under Nigerian law,” he said.
He argued that organisations that embed privacy protections into their operations would be better positioned to build lasting relationships with their audiences, adding that consent should not be treated as an administrative requirement to be completed after marketing decisions have been made.
The Nigeria Data Protection Act 2023 establishes the legal framework for processing personal data in the country, building on the constitutional right to privacy. The NDPC’s General Application and Implementation Directive, which became operational on September 19, 2025, provides further guidance on compliance obligations.
Ginger-Eke said organisations must obtain valid consent in circumstances where the law requires it, including certain direct marketing activities, the processing of sensitive personal information and children’s data, as well as specified cross-border data transfers and automated decisions with legal or similarly significant effects.
He explained that consent must be freely given, specific, informed and unambiguous, with organisations required to demonstrate that individuals have agreed to the processing of their information.
Pre-selected consent boxes and silence, he said, do not constitute valid consent, while individuals must also be able to withdraw their permission.
The consultant warned that organisations that fail to meet data protection requirements could face regulatory sanctions, pointing to enforcement actions involving companies in Nigeria and other jurisdictions.
He cited the ₦766 million penalty imposed on MultiChoice Nigeria in July 2025 and the ₦555.8 million fine imposed on Fidelity Bank in 2024 as examples of regulatory enforcement. He also referenced a US$262 million penalty order involving Meta, which he said had since been settled.
According to Ginger-Eke, enforcement actions in South Africa and the European Union also demonstrate the risks associated with obtaining consent through bundled agreements, using personal information beyond the purpose for which it was collected and delaying responses to regulatory inquiries.
To address the challenges, he proposed a five-pillar framework, which he called the Data Trust Playbook, to guide public relations agencies, advertising firms and creators in handling audience information.
The framework covers consent by design, transparency by default, governance of audience intelligence, accountability among creators and influencers, and the use of trust as a component of brand value and regulatory preparedness.
He also outlined practical steps organisations could take within 30 days to strengthen their data protection practices.
These include identifying all the channels through which personal information enters their operations, including online forms, direct messages, event registration lists and tracking technologies, and replacing pre-selected or bundled consent options with separate and specific choices.
Agencies were also advised to clarify their responsibilities as data controllers, processors or joint controllers for individual campaigns and include appropriate data protection clauses in contracts with influencers and other service providers.
Ginger-Eke further recommended that organisations conduct a 72-hour data breach simulation covering internal response procedures, public holding statements and notifications to affected individuals.
He urged agencies to designate personnel responsible for data protection and engage licensed Data Protection Compliance Organisations where registration, audit returns or other applicable regulatory obligations require their involvement.
He noted that discussions across the summit repeatedly returned to reputation and trust, arguing that privacy safeguards should form part of how organisations build credibility in Nigeria’s increasingly data-driven digital economy.
The 11th Nigeria Digital PR Summit, organised as a professional industry initiative by Upticomm Marketing Company, was held in Lagos under the theme “The Rise of Digital Influence: Culture, Creators and the New PR Playbook.”
