Almost every Nigerian with an active phone line knows the experience.
A number you do not recognise calls.
The person already knows your first name.
They want to offer a loan, insurance, property, investment, data plan or other product.
Sometimes the call comes from a company you have never dealt with.
Sometimes an SMS arrives immediately after you decline.
The first reaction is usually irritation.
The more important reaction should be curiosity.
Where did the company get your phone number?
That question sits at the intersection of telecommunications regulation, consumer rights and data protection.
Nigeria already has rules designed to protect subscribers from unsolicited commercial communications. The Nigerian Communications Commission operates the Do-Not-Disturb service. The Nigeria Data Protection Act gives individuals rights relating to direct marketing. The NCC has also warned telemarketers against harvesting or using subscriber information without approval.
The gap is often not the absence of rules.
It is that consumers do not know them, companies interpret them loosely and enforcement can feel distant.
Unsolicited marketing is not the same as every commercial call
Businesses are allowed to market products.
Marketing itself is not illegal.
The issue is whether the company has a lawful basis to use your personal information and whether you have been given a meaningful choice.
A bank may have a legitimate relationship with an existing customer.
A telecoms operator may need to communicate service information.
A company may send a message that a customer agreed to receive.
That is different from buying a list of phone numbers and calling people who have never given consent.
The distinction is consent and purpose.
A phone number is personal data when it can be linked to an individual.
How it is collected and used therefore matters.
Nigeria’s Data Protection Act gives you a direct-marketing right
The Nigeria Data Protection Act 2023 is important in this discussion.
The law gives a data subject the right to object to processing for direct marketing purposes.
Where a person objects, the personal data should no longer be processed for that purpose.
This principle is simple.
If a company is using your information to sell to you, you should be able to say no.
That right becomes meaningful only if businesses maintain systems that actually record the objection.
A customer should not have to opt out repeatedly from the same campaign.
Consent must be more than a hidden sentence
Many Nigerians technically “agree” to long terms and conditions without reading them.
Companies sometimes rely on broad consent language buried inside account-opening forms or digital applications.
Good data practice should be clearer.
If a company intends to use your number for marketing or share it with partners, that purpose should be explained in understandable language.
Consent should not be manipulated.
A person applying for a loan should not be forced to accept unrelated marketing from multiple companies unless that processing is genuinely necessary for the service.
Data protection becomes meaningless if consent is treated as a legal box rather than a real choice.
The NCC’s Do-Not-Disturb service is a practical tool
The Nigerian Communications Commission introduced the Do-Not-Disturb service to help subscribers control unsolicited promotional communications.
The short code is 2442.
Consumers can activate full DND by sending STOP to 2442.
The service also allows partial preferences for categories such as banking, real estate, education, health, tourism, sports and other commercial messages.
This is useful because not every consumer wants to block every promotion.
Someone may want banking offers but not property messages.
The system attempts to give that choice.
The problem is that many Nigerians either do not know the service exists or believe it does not cover calls coming from third-party marketers.
DND is not a licence for companies to ignore data protection
A business should not reason that it can collect any phone number it wants because the consumer can always activate DND.
That reverses responsibility.
The company has an obligation to use personal data lawfully.
The consumer’s ability to block communication is an additional protection.
The NCC has warned that no service provider or telemarketer is authorised to harvest or use subscriber data through dishonest means for commercial purposes.
This is the core of the issue.
The strongest question is not only, “How do I stop this call?”
It is, “How did this company obtain my number?”
Loan apps created a wider awareness problem
Nigeria’s digital-lending boom made data privacy more visible to ordinary consumers.
Some loan applications historically sought broad access to contacts, messages or other phone permissions.
Regulators have since increased scrutiny.
The lesson extends beyond lending.
Consumers are beginning to understand that a phone number, contact list and transaction history have commercial value.
Businesses use data to target products.
That can improve convenience when done responsibly.
It becomes exploitative when consumers do not understand how the data moved from one organisation to another.
Banks have a special trust obligation
Banks hold some of the most sensitive information about customers.
They know names, addresses, transaction patterns and financial histories.
Customers therefore expect a higher level of care.
Marketing from a customer’s own bank is different from a call by an unknown third party that appears to know financial information.
Banks need strong controls over vendors and outsourced marketers.
If a bank uses an external call centre, the customer’s data should still be protected.
Outsourcing a marketing function does not outsource responsibility.
Telcos sit at the centre of the ecosystem
Telecom companies manage the networks through which calls and messages move.
This gives them an important consumer-protection role.
They must implement DND controls and respond to complaints.
They also hold subscriber information that must be protected.
The NCC’s consumer rules require transparent service information and complaint handling.
As digital marketing becomes more sophisticated, telcos will need better tools for detecting abusive messaging patterns and repeated nuisance calls.
But network controls cannot solve every problem.
A marketer can use ordinary phone lines, internet calling or multiple numbers.
That is why data governance and enforcement must work together.
Caller identification can help, but it can also mislead
Smartphones increasingly use crowd-sourced caller-identification services.
These services can label suspected spam.
They are useful.
But they are not perfect.
A legitimate business may be wrongly flagged.
A fraudulent caller may use a new number.
Consumers should therefore avoid treating a caller-ID label as proof.
The more important protection is to be cautious about sharing personal information with an unsolicited caller.
A bank, lender or government agency should not pressure a consumer to reveal passwords, PINs or one-time codes.
Spam and fraud sometimes overlap.
Consumers should separate nuisance marketing from fraud
Not every unwanted call is a scam.
A real company may be marketing badly.
A scammer may pretend to be a real company.
The response differs.
For nuisance marketing, the consumer can opt out, use DND, complain to the company or escalate to regulators.
For suspected fraud, the priority is to stop the conversation, avoid sharing information and report the incident through appropriate channels.
Confusing the two can weaken enforcement.
Regulators need complaints that clearly describe what happened.
What to do when you receive repeated unsolicited calls
The first step is to tell the caller clearly that you do not consent to further marketing.
Ask the company name.
Ask how it obtained your number.
Record the date and number if the calls continue.
Activate or check DND status using 2442.
If the issue involves a telecom provider or persistent telemarketing, the NCC provides complaint channels, including its consumer support systems.
If the concern involves misuse of personal data, a complaint may also fall within the mandate of the Nigeria Data Protection Commission.
If the communication appears deceptive or fraudulent, other consumer-protection or law-enforcement channels may become relevant.
The key is documentation.
Businesses need a suppression list
A responsible marketing organisation should maintain a suppression list.
This is a record of people who have said they do not want direct marketing.
The purpose is not to keep marketing to them.
It is to make sure future campaigns exclude them.
This is an important operational detail.
A company can have a beautiful privacy policy and still violate consumer preferences if different departments use disconnected databases.
Data protection requires systems, not slogans.
Purchased databases are a major risk
The informal sale of customer data is one of the least transparent parts of Nigeria’s digital economy.
Phone numbers can move through agents, forms, event registrations, merchants and third-party vendors.
Once copied into a marketing list, it can be difficult for the consumer to know the original source.
Companies should be careful about buying lead databases.
A cheap list of “verified customers” can create significant legal and reputational risk if consent cannot be demonstrated.
The more Nigeria enforces data law, the less attractive this business model should become.
Consent should have an expiry mindset
A person who gave a number to a company five years ago may not reasonably expect endless marketing.
Good organisations should periodically review whether old marketing consent remains appropriate.
This is especially important when products change or data are shared across business groups.
The principle is purpose limitation.
Information collected for one reason should not quietly become permission for every future commercial use.
Regulators need to make complaint outcomes visible
Consumers are more likely to use complaint channels when they believe complaints produce results.
NCC, NDPC and consumer-protection agencies should publish anonymised enforcement statistics.
How many complaints were received?
What sectors generated the most complaints?
How many businesses were warned or sanctioned?
What were the common violations?
This would help companies understand regulatory expectations and give consumers evidence that the system works.
Marketing itself can improve when consent improves
Some businesses fear that stronger privacy rules will make marketing harder.
Poor marketing should become harder.
Good marketing can become better.
A person who genuinely opted in is more likely to be interested.
A company that respects preferences builds trust.
Accurate customer data can improve conversion.
The future of digital marketing should be permission-based rather than volume-based.
Calling thousands of unwilling people is not sophisticated marketing.
It is inefficient noise.
Nigeria should move towards verifiable marketing identity
One long-term improvement would be stronger identification of commercial callers.
Consumers should be able to know when a call comes from a verified bank, insurer, telecom company or licensed lender.
This could reduce fraud and make legitimate marketing more accountable.
Implementing such a system would require coordination among regulators, networks and businesses.
But the principle is valuable.
An anonymous commercial call should become less normal.
Privacy is becoming part of customer service
Nigerian companies increasingly compete on apps, speed and convenience.
They will also compete on trust.
A bank that protects customer data has an advantage.
A retailer that does not sell contact details builds loyalty.
A digital platform that makes consent understandable reduces future disputes.
Privacy should therefore not be seen only as a legal-compliance cost.
It is part of brand quality.
Your phone number is not public property
A phone number may feel ordinary because people share it every day.
But it is still personal information.
Giving it to one company does not mean every marketer should have it.
Nigeria’s regulatory framework increasingly recognises this.
Consumers have a role too.
Read permissions.
Avoid unnecessary form filling.
Use DND where appropriate.
Ask companies to remove you from marketing lists.
Report persistent abuse.
The country’s digital economy will become stronger when businesses can reach willing customers and consumers can refuse unwanted attention.
The first step is changing the assumption.
Your phone number is not a free marketing resource simply because someone found it.
Consent still matters.
Sources and further reading
- NCC Consumer Portal: Do-Not-Disturb service
- Nigeria Data Protection Act 2023
- NCC public notice on unauthorised use of subscriber phone numbers
Reader conversation
0 approved comments