Section 26, NDPA
Consent
(1) A data controller shall bear the burden of proof for establishing a data subject’s Consent
(2) In determining whether consent was freely and intentionally given, account shall be taken of whether, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
(3) Silence or inactivity of the data subject shall not constitute consent.
(4) Where the processing of personal data is based on the consent of the data subject, the data subject shall be informed of the right to withdraw consent, prior to the granting of consent.
(5) The withdrawal of consent under subsection (4) shall not affect the lawfulness of data processing that occurred before the withdrawal of the consent.
(6) A request for consent shall be in clear and simple language and accessible format.
(7) Consent —
(a) shall be in the affirmative, and not based on a pre-selected confirmation;
and
(b) may be provided in writing, orally, or through electronic means.
This is Section 26 of the Nigeria Data Protection Act 2023. To explore the rest of the legislation, please use the links below:
- See the Full Act (Index)
- Next, Read Section 27: Provision of information to the data subject
- Back to Section 25: Lawful basis of personal data processing