Landmark Data Privacy Ruling-Domino Pizza & Mr Araka

A recent Federal High Court ruling has set a significant precedent for data protection compliance in Nigeria. The case against Domino’s Pizza, which resulted in a fine for violating a customer’s right to privacy, highlights the importance of businesses handling customer data lawfully.

The Case: How Unsolicited Messages Led to a Legal Battle

On December 14, 2023, Chukwunweike Araka Akosa received an unsolicited marketing message from Domino’s Pizza, which began with “Hi Jumians.” This suggested that his data had been obtained from Jumia Food, where he had previously placed an order.

Despite his efforts to stop the messages, they persisted 16 times by May 25, 2024. Frustrated, he contacted Jumia Food, which responded but could not resolve the issue. Seeking justice, he filed a lawsuit against Domino’s Pizza for unauthorized use of his personal data.

Court’s Verdict & Implications

On February 18, 2025, Justice Emeka Nwite ruled that Domino’s Pizza violated:

✅ Section 37 of the Nigerian Constitution (Right to Privacy)

✅ Sections 25 & 26 of the Nigeria Data Protection Act (NDPA) 2023 (Unlawful Processing of Personal Data)

The court found that:

✔️ Domino’s Pizza acted as a data processor and had no legal right to repurpose customer data without explicit consent.

✔️ Jumia Food had warned Domino’s to stop processing Akosa’s data, fulfilling its duty of care.

✔️ Domino’s was solely liable for ignoring Akosa’s formal request to remove his data.

As a result, the court ordered ₦3 million in damages and mandated Domino’s Pizza to erase Akosa’s data and stop direct marketing communications.

What This Means for Business Owners

This ruling reinforces the need for strict data privacy compliance. Businesses must ensure:

🔹 Explicit consent is obtained before using customer data for marketing.

🔹 Data-sharing agreements comply with NDPA regulations.

🔹 Non-compliance has legal and financial consequences.

How to Stay Compliant

To avoid similar legal risks, businesses should take these essential steps:

📌 File a Data Protection Audit — Work with a licensed Data Protection Compliance Organization (DPCO) to submit an audit before March 15, 2025.

📌 Register as a Data Controller or Processor — Ensure compliance with the Nigeria Data Protection Commission (NDPC).

📌 Update Privacy Policies — Align data processing policies with current regulations.

📌 Conduct a Data Privacy Impact Assessment (DPIA) — Evaluate risks in handling sensitive data.

📌 Train Your Team — Educate board members, employees, and senior management on compliance requirements.

At Seeds Attorneys, we provide expert legal guidance, compliance support, and training services to help your organization navigate the evolving data protection landscape.

📩 Need help ensuring your business is compliant? Contact us today at info@seedsattorneys.com.ng.