Proof, Not Promises: Why Consent Receipts Are Becoming the Backbone of Data Protection Compliance in Nigeria
Ask a Nigerian organisation whether it has consent to process its customers’ data, and the answer is usually a confident yes. Ask it to prove that consent for one specific person, covering what they agreed to, when, under which version of the privacy notice, and whether they have since withdrawn, and the room goes quiet.
That silence is the compliance gap. Closing it is one of the most practical things a business can do under the Nigeria Data Protection Act (NDPA) 2023.
Consent is a burden of proof
The NDPA treats consent as one of several lawful bases for processing, and it sets a real standard for relying on it. Consent must be freely given, specific, informed and unambiguous. It must also be as easy to withdraw as it was to give. Underneath all of this sits the accountability principle: the controller must be able to demonstrate compliance, not merely assert it.
In practice, a ticked box on a website is not evidence. A database row reading “consent = true” is not much better. If the Nigeria Data Protection Commission (NDPC) opens an investigation, or a data subject lodges a complaint, the organisation has to reconstruct what happened. Which purposes did this person agree to? What did the notice say on that day? Was the consent specific, or bundled with unrelated purposes?
Most organisations cannot answer these questions because they never designed their systems to.
What ISO/IEC TS 27560:2023 brings
ISO/IEC TS 27560:2023, Privacy technologies — Consent record information structure, offers a way out. It is a technical specification, not a legal instrument, and it does not tell you what the law requires. It defines how consent information should be structured so that records are consistent, complete and interoperable.
It addresses three things:
- Consent record structure. The information to capture when consent is given, including the individual, the purposes, the notice version, the timestamp and the processing details.
- Consent receipts. A copy provided to the individual, giving them tangible confirmation of what they agreed to.
- Lifecycle management. Consent is not a single event. It can be changed, renewed, withdrawn or expire, and each change must be recorded.
This maps closely onto what the NDPA and the NDPC’s General Application and Implementation Directive (GAID) expect: transparency toward data subjects, demonstrable accountability for controllers, and respect for the right to withdraw.
From a form to a lifecycle
A compliant consent process works as a chain, and each link matters.
Collection. Consent is gathered through a hosted form, an embedded web form or an app, with purposes presented separately and not buried in general terms.
Structured record. The individual’s choices, the purposes, the exact version of the privacy notice shown, the timestamp and the relevant processing details are stored in a defined structure. Versioning matters more than people realise. A privacy notice changes, and you must be able to show which version a person actually saw.
Receipt. The individual receives a PDF receipt with a unique reference linked to the stored record. This is the transparency principle made tangible.
Delivery. The receipt is emailed automatically, and the delivery status is tracked. An undelivered receipt is a gap in your evidence trail.
Ongoing management. The organisation can retrieve records, resend receipts, process withdrawals and keep an audit history of every change.
Done well, this chain gives a Data Protection Officer something rare: a defensible answer to “show me.”
Why this matters across Africa
Nigeria is not alone. South Africa’s POPIA, Kenya’s Data Protection Act, Ghana’s Data Protection Act and a growing list of continental frameworks all place weight on demonstrable, specific and withdrawable consent. Many African businesses operate across borders, and a consistent, standards-based consent record travels better than a patchwork of ad hoc forms.
There is also a fairness argument. Small and medium-sized enterprises are often told to be compliant with little guidance on how. A standardised structure lowers the barrier. It gives a ten-person fintech or an online retailer the same evidentiary foundation as a large bank, without a large legal budget. That is proportionate compliance in practice. The substance of accountability, delivered through tooling rather than bureaucracy.
A caution about claims
One distinction deserves emphasis. Generating a PDF receipt does not make a system ISO certified. ISO/IEC TS 27560 is a technical specification, and conformance has to be validated across the whole implementation. The record structure, the receipt content, the lifecycle handling and the documentation. Organisations and vendors should aim to conform, test against the standard, document how they did so, and describe their claims accurately.
Overstating compliance is its own risk. Regulators and clients increasingly test marketing language against evidence. Honest positioning, such as designed to align with ISO/IEC TS 27560:2023, with conformance testing documented,” builds more durable trust than a badge you cannot support.
Practical steps for organisations
- Audit how you collect consent today. Can you show who agreed to what, and when?
- Separate your purposes. Bundled consent is weak consent.
- Version your privacy notices and link every consent to the version shown.
- Give individuals a receipt and make withdrawal as easy as agreement.
- Keep an audit trail of every change in a consent’s lifecycle.
- Be precise in your claims about standards and certification.
The bottom line
Data protection in Nigeria is moving from policy documents to operational evidence. The NDPC’s growing enforcement posture and the maturing GAID framework make it clear that the question is no longer: ’do you have a privacy notice? but ‘can you prove what you did with it?’
Consent receipts built on a recognised structure turn that burden of proof into a routine system output. For organisations serious about accountability, that is not a feature to postpone. It is the foundation.
