Federal Gazette
4notify Nigeria · Federal Republic notices
OFFICIAL · NDPC · NDPA 2023
Gazette No
FG-NG-005
Date
2026-05-27
Status
In force
Category
Privacy

NDPC, the NDPA 2023 and consent: the permission framework for transactional and commercial delivery

The Nigeria Data Protection Commission (NDPC) enforces the Nigeria Data Protection Act 2023 (NDPA). Commercial communication requires consent, and sensitive personal data carries reinforced protection. 4notify records the lawful basis on every envelope and verifies consent at the API edge before each delivery.

EmailSMSWebhook
Preamble

Section 1 — In exercise of the powers conferred by the Nigeria Data Protection Act 2023 and the regulations of the Nigeria Data Protection Commission, this Gazette is issued concerning consent management in electronic delivery.

Statutory basis
Nigeria Data Protection Act 2023 (NDPA)

Lawful bases of processing, data-subject rights and the mandate of the NDPC.

NDPC Registration of Data Controllers

Obligation on controllers of major importance to register with the NDPC.

NDPC consent and breach guidance

Informed consent, the right to withdraw and the breach-notification timeline.

Implementation
01

Lawful basis recorded per delivery

Each envelope carries one NDPA lawful basis (consent, contract, legal obligation, legitimate interest); it is pinned in the template register.

02

Commercial consent verification

On marketing messages, consent is verified at the envelope level; sends without permission are blocked at the API edge.

03

Right to erasure within 30 days

Erasure requests propagate within 24 hours through 4notify; the suppression list updates across all four operators and the email gateway.

04

Breach-notification webhook

Any envelope-level incident raises a webhook to the data controller in under 1 hour, supporting the NDPC 72-hour reporting duty.

Delivery envelope
json
{
  "event": "delivery.consent_envelope",
  "controller_id": "NG-CTRL-12345",
  "lawful_basis": "consent",
  "consent": {
    "record": "NDPC-2026-001234",
    "consent_date": "2025-09-14",
    "opt_out_link_present": true
  },
  "delivery": { "channel": "email", "template": "promo_v2" },
  "suppression_check": "passed"
}
Sample message
EmailSubject: We have updated your marketing preference

Dear customer, From today your marketing permission is withdrawn. You will no longer receive promotional emails, but you will still receive transactional notices (order confirmations, delivery alerts). To exercise your other rights under the NDPA 2023: [email protected]

Compliance checklist
  • NDPC data-controller registration current (where required)
  • Data controller configured
  • Consent retained for each commercial delivery
  • Breach-notification webhook reachable
The 4notify difference

4notify is the only A2P provider that pins the NDPA 2023 lawful basis on every envelope, propagates erasure in under 24 hours across all four operators and raises an NDPC breach webhook on every incident.

Frequently asked questions
Does consent apply to SMS too?

Yes — the NDPA 2023 covers every commercial communication that uses personal data: SMS, email, messaging. Each one needs a valid lawful basis at the envelope level.

What if the controller has not registered with the NDPC?

4notify blocks commercial delivery at the API edge until a valid registration is in place; transactional delivery on a contractual basis (order confirmations, delivery alerts) stays available.

Published by authority
4notify Operations Department
2026-05-27 · FG-NG-005

Start free

14 days, no card. English support on weekdays. Built for Nigerian business.

Other notices in this issue