A dispute over unwanted marketing texts has become one of the first major test cases of the Nigeria Data Protection Act, and a warning shot to banks, fintech and telecommunication companies still sending emails to customers who no longer use their services, writes JULIANA UCHE-OKOBI.
For many Nigerians, closing a bank account simply brings to an end a relationship between a bank and its customer. That process entails that an individual settles his balance, signs the closure form and walks away. But in 2025, two businessmen, David Ogundipe and Salami Tolulope Ibrahim, realised that many institutions do not let the matter end with that simple exercise. The duo discovered that while an individual signs out, his data does not leave with him. This they would not condone.
The two businessmen had operated a corporate account with Stanbic IBTC before shutting it down over unresolved issues with the bank. In apparent compliance, the bank closed the account. With that, the duo had thought they drew the curtains on their engagement with the bank but that was not so. To their surprise, promotional emails and text messages did not stop, as the bank bombarded both their corporate and personal phone numbers with messages long after the account and the consent that came with it was gone.
Worried by the development, they asked the bank to stop. According to court filings, Stanbic IBTC acknowledged the request but did not comply, as its promotional messages continued. Unable to bear it any longer, the businessmen approached the court.
On July 29, 2026, Justice Kayode Agunloye of the Federal Capital Territory High Court, Abuja, delivered judgment in Ogundipe & Ibrahim v. Stanbic IBTC (Suit No: CV/2190/25). The court held that the bank had no lawful basis to keep processing the claimants’ personal data once the banking relationship ended and consent was withdrawn. The court found that Stanbic IBTC breached the Nigeria Data Protection Act (NDPA), 2023, violated the claimants’ constitutional right to privacy under Section 37 of the 1999 Constitution, and engaged in an unfair trade practice under the Federal Competition and Consumer Protection Act (FCCPA), 2018.
The claimants had asked for ₦250 million in damages. But in awarding penalty, the court, which described such demand as “excessive,” awarded ₦15 million instead. That amount included the general damages for unlawful data processing, the bank’s failure to act on repeated erasure requests, and the invasion of privacy that followed. But that was not all about the penalty. The court also ordered Stanbic IBTC to pay ₦500,000 as cost of suit, with 10 percent yearly interest to accrue on the awards until they were fully settled.
The court judgement went beyond financial penalty on the part of Stanbic IBTC. In addition to its ruling that Stanbic IBTC must erase every piece of the claimants’ personal data that it was not legally obligated to retain, the court also gave a perpetual injunction restraining the bank, its agents and assigns from further processing, transmitting or using that data for marketing or any purpose not backed by law or consent.
However, the judgement did not automatically stop banks from withholding certain class of data about an indinvidual. Justice Agunloye actually drew a line, as he declined to order wholesale deletion of all customer records, noting that banks remained bound by the Central Bank of Nigeria (CBN) and anti-money laundering rules that required certain documents to be kept, regardless of what a customer wanted erased.
The Stanbic IBTC judgement has since elicited reactions from Nigeirans. Jeremiah Ihuoda, a businessman, who also narrated how an unnamed bank has also continued to send him messages, said the court should direct all banks to cease from such unsolicited messages.
“I really don’t know what to do with the messages they send. Sometimes they are telling you to buy credit from them, at other times they are advertising their products. It is really annoying,” Ihuoda said.
Janet Alfred, a dealer in tailoring materials at Abule-Egba, Lagos, who complained about the incessant messages her bank sends to her and for which her account is also charged, said government should also order banks to stop depleting customers’ account balance through unsolicited messages.
“My bank sends me account balance at the end of every month, which I did not ask for and for this they charge me N18. This has been going on for as long as I can remember. I have stopped putting money in the account so when they have exhausted what is in the account, they would stop, maybe,” Alfred said.
Though the Stanbic IBTC court judgement was not about SMS charges but marketing promotional messages, it is believed that the judgement would influence how banks and telecommunication companies relate with their customers, especially former customers who no longer need their services.
The legal counsel to the claimants in the Stanbic IBTC case, O.E. Oluwadamisi, believes so.
Reacting to the judgement, which he described as a major victory for data privacy in Nigeria, he warned that organisations could no longer keep exploiting customers’ personal information once consent has been withdrawn.
Ogundipe, one of the claimants, said the outcome of the case was not just a victory for him and his co-claimant but also for millions of Nigerians. He maintained that people should not lose control of their personal information simply because they once did business with a company.
Efforts to get Stanbic IBTC to comment on the judgement before this report went for publication did not yield any result as electronic mails sent to the company were not answered.
Meanwhile, Ogundipe’s principle found support in Section 24 of the NDPA, which grants Nigerians a right to erasure: if a data subject withdraws consent, or the purpose for which their data was collected no longer exists, they can demand deletion, and if ignored, they can sue.
Since it came into force in 2023, the Nigeria Data Protection Commission (NDPC), led by its National Commissioner, Dr. Vincent Olatunji, has been steadily tightening the screws on data controllers. Before now, the commission had sanctioned banks and other companies for data breaches, and industry trackers now estimate that Nigerian regulators have collected roughly ₦7.2 billion in data-protection penalties to date, positioning Nigeria as one of Africa’s most assertive enforcement environments.
In March 2025, the NDPC issued the General Application and Implementation Directive (GAID), formally retiring the old 2019 regulation and consolidating its enforcement powers, including the authority, upheld by a court just a day before the Stanbic IBTC judgement, to compel data controllers and processors to register with it.
What makes the Stanbic IBTC case notable is not the size of the award, ₦15 million. Rather, it is the fact that ordinary customers, not the regulatory body, who took a Tier-1 bank to court and won a judicial finding of NDPA breach, backed by a perpetual injunction. Analysts believe that this is a signal that the Act’s promises are enforceable not only through NDPC sanctions but also through private litigation.
Therefore, for banks, fintechs, telecommunication companies and any business running bulk SMS or email campaigns, the judgement has sent a stern warning. An old customer list is not a permanent marketing asset. And as Ihuoda put it, “consent has an expiry date, and the fact that a company already had your data is no longer a defence once a customer asks you to stop.”
If the messages continue to come after a customer has requested that they stop, an individual can proceed to court. Under Section 24 of the NDPA, a person has a legal right to demand erasure. If the organisation ignores the request, the Federal Capital Territory High Court judgment against Stanbic IBTC is a pointer to what may befall such an organisation.