The Right to Object to Direct Marketing under the NDPA: A Review of Onimisi v GTCO (FHC/ABJ/CS/1181/2025)

CONTRIBUTOR: OKOSA MARYCYNTHIA CHINWENDU

Introduction

Unsolicited direct marketing communications have long raised concerns about consumer privacy in Nigeria. The Nigeria Data Protection Act 2023 (NDPA) now places those concerns within a comprehensive statutory framework for processing personal data. Section 25 requires every processing operation to rest on a lawful basis, while section 36 gives a data subject a specific right to object to processing for direct marketing. The structure of section 36 is important: although a controller may, in limited circumstances, resist a general objection by demonstrating overriding public interest or other legitimate grounds, no equivalent exception applies once a data subject objects to direct marketing. The personal data may no longer be processed for that purpose.^[1]

The Federal High Court’s decision in Abdulmalik Muhaimin Onimisi v Guaranty Trust Holding Company Plc is one of the earliest judicial applications of the NDPA to unsolicited direct marketing. It is significant not only for enforcing the right to object, but also for its treatment of lawful basis, transparency, data provenance, and constitutional privacy. This article examines the facts, reasoning and remedies in the case. It considers the proper reach of the decision in light of the NDPA and the Nigeria Data Protection Commission’s subsequent General Application and Implementation Directive 2025 (GAID).^[2]

Facts of the Case

The Applicant, Mr Abdulmalik Muhaimin Onimisi, was not a customer of GTCO or any of its subsidiaries and had not supplied them with his personal data. On 9 April 2025, he received an unsolicited promotional text message advertising “Fund 724”, an investment product of Guaranty Trust Fund Managers, a GTCO subsidiary, and offering a return of 17.5 per cent. The message contained no mechanism for opting out of further marketing communications.^[3]

On 10 April 2025, the Applicant emailed GTCO requesting disclosure of the source of his personal data and the lawful basis for its processing, immediate cessation of the marketing communications, and deletion of his data from the company’s systems. GTCO’s customer experience team acknowledged the complaint and indicated that it would be resolved. Nevertheless, on 23 April 2025, the Applicant received another promotional message in the same series. He then commenced proceedings at the Federal High Court, Abuja, seeking declaratory and injunctive reliefs, disclosure of the source of his data and damages.^[4]

Decision of the Federal High Court

A procedural dispute arose over service of the originating processes. GTCO was the named Respondent, while Guaranty Trust Bank Ltd, a separate subsidiary, appeared and argued that the processes had been served on the wrong legal entity. The court rejected that objection. GTCO did not contest the substantive allegations on their merits, and the court determined the application on the evidence before it.^[5]

On the substantive issues, Egwuatu J held that GTCO was responsible for the impugned processing and considered the principles in section 24 and the lawful bases in section 25 of the NDPA. On the facts proved, the court found that GTCO had established none of the six lawful bases for processing the Applicant’s personal data for the marketing activity. The Applicant had no customer or contractual relationship with the Respondent, had not supplied his personal data to it, and had not consented to the processing; nor did the Respondent demonstrate any other lawful basis.^[6]

The court further held that the second marketing communication, sent after the Applicant had expressly objected, violated section 36 of the NDPA. Sections 36(3) and (4) permit a data subject to object at any time to processing for direct marketing and require the controller to stop processing the data for that purpose once the objection is made. The court also found that the conduct implicated the Applicant’s constitutional right to privacy under section 37 of the Constitution of the Federal Republic of Nigeria 1999 (as amended). That conclusion accords with appellate authority recognising data protection as falling within the constitutional protection of privacy and protecting the privacy of personal telephone communications.^[7]

As to remedies, the court granted declarations that the processing was unlawful and contrary to section 37 of the Constitution and sections 24, 34, 35 and 36 of the NDPA. It ordered GTCO to cease further direct marketing communications concerning Fund 724 and to disclose the source from which the Applicant’s personal data had been obtained, including any third parties or data brokers involved.^[8]

The court also awarded ₦200,000 in general damages and ₦50,000 as costs. The monetary award was substantially below the sums claimed, including the Applicant’s claim for ₦35 million in general damages and ₦5 million in exemplary damages.^[9]

Critical Analysis of the Decision

The Right to Object to Direct Marketing

The clearest and most important aspect of Onimisi is its enforcement of the specific right to object to direct marketing. Section 36 distinguishes between an objection to processing generally and an objection to processing for direct marketing. Under section 36(2), a controller may continue processing following a general objection if it demonstrates public interest or other legitimate grounds that override the data subject’s rights and interests. Sections 36(3) and (4), however, contain no comparable balancing exercise for direct marketing. Once the data subject objects, the data may no longer be processed for that purpose.^[10]

The second message sent to the Applicant after his written objection therefore presented the strongest part of the claim. Whatever argument might have been available about the original lawful basis for the first communication, the continued use of the Applicant’s data for direct marketing after the objection was inconsistent with the express command in section 36(4). The decision gives practical force to a right that would otherwise be ineffective if controllers could delay or subject an objection to further internal approval.

Lawful Basis and the Proper Reach of Onimisi

The judgment should, however, be stated with precision. It establishes that GTCO failed to establish any lawful basis on the facts before the court; it should not be converted into a general rule that a person’s status as a non-customer automatically excludes every lawful basis under section 25. Consent and contract were plainly unavailable on the evidence in Onimisi, but other statutory bases, such as legal obligation, vital interest or public interest, do not invariably depend on the existence of a customer relationship. Their applicability must be assessed against the purpose and circumstances of the particular processing.^[11]

The position on legitimate interest also requires care. Section 25(2) expressly provides that an interest is not legitimate where it overrides the data subject’s rights and interests, is incompatible with the other lawful bases identified by the Act, or the data subject would not reasonably expect the processing in the manner envisaged. In Onimisi, the absence of any prior relationship, the unexplained source of the telephone number and the use of the data for unsolicited marketing strongly undermined any claim that the Applicant could reasonably have expected the processing. The court was therefore entitled, on the evidence before it, to reject legitimate interest. More importantly, once the Applicant objected, section 36(4) independently required the direct-marketing processing to stop.^[12]

Source Transparency and the Remedies Granted

The order requiring GTCO to disclose the source of the Applicant’s personal data is a particularly important aspect of the judgment. Section 34(1)(a)(vii) of the NDPA entitles a data subject, where personal data was not collected directly from that person, to obtain any available information as to its source. The order therefore addresses a central transparency concern in modern data-driven marketing: a controller must be able to account not only for why it is processing personal data, but also for where that data came from.^[13]

The damages award is more debatable. An award of ₦200,000 in general damages may appear modest when measured against the resources of a large financial group and the need for effective deterrence. Nevertheless, the significance of the judgment is not confined to the quantum. The declaratory orders, the prohibition on further marketing and the order for disclosure of data provenance impose compliance consequences beyond the monetary award. Future cases will determine whether Nigerian courts develop a more settled approach to compensation for unlawful data processing and privacy infringements.

The Current Regulatory Position under the GAID

The regulatory position has become clearer since the events that gave rise to Onimisi. Article 18(1)(a) of the GAID now expressly provides that consent is required “for any direct marketing activity”. This provision materially narrows the scope for debate over whether legitimate interest may support direct marketing under the present Nigerian regulatory framework.^[14]

The temporal distinction is important. The messages in Onimisi were sent in April 2025. Although the GAID was issued on 20 March 2025, it formally came into force on 19 September 2025 following a six-month implementation period. Article 18 should therefore not be treated as the legal basis on which the court determined GTCO’s April 2025 conduct. Its significance is prospective: for current compliance, a controller engaged in direct marketing must satisfy the GAID’s consent requirement in addition to respecting the data subject’s right to object under section 36 of the NDPA.^[15]

Legitimate interest remains a lawful basis for other processing under section 25, and the GAID requires a controller relying on it to undertake and document a Legitimate Interest Assessment. That general mechanism does not, however, displace the more specific consent requirement imposed by Article 18 for direct marketing.^[16]

Comparative Perspective

The comparison with European data protection law must also be framed carefully. Recital 47 of the European Union’s General Data Protection Regulation (GDPR) recognises that direct marketing may, in appropriate circumstances, constitute a legitimate interest. Yet Article 21(2) and (3) give the data subject an absolute right to object to processing for direct marketing, after which the personal data may no longer be processed for that purpose. The structure is therefore similar to section 36 of the NDPA as regards the effect of an objection. However, Nigeria’s current GAID goes further by expressly requiring consent for any direct marketing activity.^[17]

In the United Kingdom, the Privacy and Electronic Communications (EC Directive) Regulations 2003 also regulate electronic marketing. Regulation 22 generally requires consent for unsolicited electronic mail to individual subscribers, subject to the statutory “soft opt-in” for certain marketing of similar products or services within an existing customer or negotiating relationship. Nigerian organisations should therefore avoid importing GDPR or UK legitimate-interest concepts into the NDPA without accounting for the more specific requirements of the GAID.^[18]

Practical Implications for Data Controllers

For financial institutions, fintechs and other organisations engaged in direct marketing, Onimisi has immediate operational implications. Objections must be captured and propagated promptly across all relevant marketing systems and channels. Where marketing functions operate across a corporate group, controllers should ensure that fragmented databases or separate campaign platforms do not defeat an objection communicated through one entity. Organisations that obtain contact details from third-party vendors or data brokers must also be able to demonstrate the data’s provenance and, under the current GAID, the consent supporting its use for direct marketing.

Separate class actions were also filed in 2025 against several banks, including GTBank and GTCO, alleging unlawful use of customer data in share-offer marketing. Those proceedings provide context for the wider compliance debate, but the allegations do not establish liability and should not be treated as proof that the conduct in Onimisi was systemic.^[19]

Conclusion

The significance of Onimisi v GTCO lies principally in its practical enforcement of the NDPA’s direct-marketing protections. The decision confirms that a controller must establish a lawful basis for processing and, crucially, that once a data subject objects to direct marketing, the processing must stop. It also gives practical effect to the data subject’s right to know the source of personal data obtained indirectly and reinforces the relationship between statutory data-protection rights and the constitutional right to privacy.

The decision should nevertheless be read according to its facts. The court’s finding that no lawful basis applied arose from the particular evidence before it and should not be treated as a universal rule that non-customer status defeats every lawful basis recognised by section 25. At the same time, the present regulatory position is now more stringent than it was when the disputed messages were sent: Article 18(1)(a) of the GAID expressly requires consent for any direct marketing activity. For data controllers, the combined lesson is clear: establish and document the legal basis and provenance of personal data before using it, obtain the consent now required for direct marketing, and honour an objection immediately and across every system through which the marketing is conducted.^[20]

Reference:

1. Nigeria Data Protection Act 2023 (NDPA), ss 25 and 36(1)–(4). ↑
2. Abdulmalik Muhaimin Onimisi v Guaranty Trust Holding Company Plc (unreported, Federal High Court, Abuja Judicial Division, Suit No FHC/ABJ/CS/1181/2025, 11 June 2026) (Egwuatu J). ↑
3. Onimisi (n 2); Adesanya AI Advisory, ‘Onimisi v GTCO: What a Nigerian Data Protection Judgment Tells Every GDPR-Regulated Company’ (24 June 2026) <https://adesanyaaiadvisory.com/article-gtco-ndpa-enforcement> accessed 27 August 2026. ↑
4. Onimisi (n 2); Adesanya AI Advisory (n 3). ↑
5. Onimisi (n 2); Omoleye Omoruyi, ‘Court Orders GTCO to Pay a Man ₦250,000 for Sending Unsolicited Marketing Messages’ (TechNext, 24 June 2026) <https://technext24.com/news/court-orders-gtco-pay-unwanted-messages/> accessed 27 August 2026. ↑
6. NDPA, ss 24(1), 25 and 65; Onimisi (n 2). ↑
7. NDPA, s 36(1)–(4); Constitution of the Federal Republic of Nigeria 1999 (as amended), s 37; Incorporated Trustees of Digital Rights Lawyers Initiative & Ors v National Identity Management Commission (2021) LPELR-55623(CA); Emerging Markets Telecommunication Services Ltd v Eneye (2018) LPELR-46193(CA); Onimisi (n 2). ↑
8. Onimisi (n 2); Emeka Onyeks, ‘Court Orders GTCO to Stop Sending Messages to Non-Customer’ (Nairametrics, 23 June 2026) <https://nairametrics.com/2026/06/23/court-orders-gtco-to-stop-sending-messages-to-non-customer/> accessed 27 August 2026; Adesanya AI Advisory (n 3). ↑
9. Omoruyi (n 5). ↑
10. NDPA, s 36(1)–(4). ↑
11. NDPA, s 25(1). ↑
12. NDPA, ss 25(2)(a)–(c) and 36(4). ↑
13. NDPA, s 34(1)(a)(vii); Onimisi (n 2). ↑
14. Nigeria Data Protection Commission, Nigeria Data Protection Act General Application and Implementation Directive 2025 (GAID), art 18(1)(a) <https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf> accessed 27 August 2026. ↑
15. Nigeria Data Protection Commission, Annual Report 2025 (2026) 19 <https://ndpc.gov.ng/wp-content/uploads/2026/02/Print_NDPC-Annual-Report-2025-1.pdf> accessed 27 August 2026; GAID (n 14), art 18(1)(a). ↑
16. GAID (n 14), art 26 and sch 8. ↑
17. Regulation (EU) 2016/679 (General Data Protection Regulation) [2016] OJ L119/1, recital 47 and art 21(2)-(4). ↑
18. Privacy and Electronic Communications (EC Directive) Regulations 2003, SI 2003/2426, reg 22. ↑
19. Sodeeq Atanda, ‘GTBank, Others Face Class Action for “Unlawfully Using Customers’ Data” in Adverts’ (Foundation for Investigative Journalism, 19 September 2025) <https://fij.ng/article/gtbank-others-face-class-action-for-unlawfully-using-customers-data-in-adverts/> accessed 27 August 2026. ↑
20. NDPA, ss 25, 34 and 36; GAID (n 14), art 18(1)(a). ↑