Uncategorized

Duty of Care in Nigeria: Why Service Providers Cannot Hide Behind NDAs.

aeolawpractice

A contract may buy a business silence, but it cannot buy immunity.

In Nigeria, a service provider’s duty of care to its customers is grounded in the law of negligence, the Federal Competition and Consumer Protection Act 2018 (FCCPA) and the Nigeria Data Protection Act 2023 (NDPA). A contractual clause imposed on a customer cannot simply override these legal obligations or shield a provider from accountability.

Introduction: When the Fine Print Speaks Louder Than the Service

Consider a hypothetical scenario. Company X, a Nigerian logistics provider, is preparing to launch a new product alongside its delivery service. When long-standing customers next open its app, they encounter a new requirement: a Non-Disclosure and Non-Disparagement Agreement for the proposed service. Their names and the date are already inserted, and the only available option is “Agree”. The agreement prohibits customers from making any negative statement or complaint about the service to anyone. It also classifies defects and security vulnerabilities they discover as confidential information. No expiry date is specified.

Company X may have earned customers’ trust, and protecting information about an unreleased product is a legitimate commercial interest. However, a clause of this nature raises wider questions about how businesses manage reputational risk. Instead of prioritising the quality, safety and reliability of their services, providers may be tempted to control what customers can say about their experiences.

This approach is particularly troubling where customers rely on a service for everyday needs. Contractual terms cannot legitimately be used to silence genuine complaints, restrict disclosures permitted or required by law, or relieve businesses of legal obligations.

This article considers why an approach of this kind may be difficult to sustain under Nigerian law. The issues are especially relevant to providers of transport, logistics, electricity, telecommunications, banking, fintech, healthcare, food and other essential goods and services.

The Duty of Care: Settled Nigerian Law for Four Decades

Nigerian courts have long applied the neighbour principle established in Donoghue v Stevenson [1932] AC 562. The principle is straightforward: where a person supplies goods or services to individuals who may reasonably be affected by their actions, that person owes them a duty to take reasonable care to prevent foreseeable harm.

The leading Nigerian authority is Nigerian Bottling Co Ltd v Ngonadi (1985) 1 NWLR (Pt 4) 739. In that case, the company sold Mrs Ngonadi a refrigerator and assured her of its safety, but the appliance subsequently caused her injury. The Supreme Court held that the company owed her a duty of care not to sell dangerous articles to consumers. Oputa JSC (as he then was) further observed that the ultimate consumer could maintain an action against the seller or any other party in the chain of distribution, up to the manufacturer.

Two points are particularly relevant to modern service providers:

  • The duty follows the risk, not the paperwork.

The duty of care arises from the relationship between the parties and the foreseeability of harm, not merely from the terms of a contract. Whether the customer has goods carried on a new delivery service, a patient receiving treatment at a clinic or is a user accessing a banking app, the provider owes a duty to exercise reasonable care, regardless of the contractual terms the customer has accepted.

  • Regulatory approval does not end the inquiry.

In Fijabi Adebo Holdings Ltd v Nigerian Bottling Co Plc & NAFDAC (Suit No LD/13/2008), the Lagos State High Court, in its 2017 decision, affirmed that a soft-drink manufacturer owes a duty of care to consumers. Although the company escaped liability on the evidence before the court, the regulator was found to have breached its own duty and was directed to require appropriate warning labels. The decision reinforces an important principle: courts will examine the responsibilities of the various parties involved, rather than treating regulatory approval as an automatic defence against liability.

The FCCPA 2018: Statutory Duties You Cannot Contract Out Of

The FCCPA translates several consumer protection principles into enforceable statutory rights. The Federal Competition and Consumer Protection Commission’s (FCCPC) own summary of consumer rights highlights the provisions that are particularly relevant to this discussion:

  • Section 124: no coercion, undue influence or unfair marketing practices in supplying goods or services.
  • Section 127: no unfair, unreasonable or unjust terms, including terms imposed as a condition of entering a transaction.
  • Section 129: any notice or agreement that limits, excludes or waives liability for defective performance, negligence or misrepresentation, or imposes an indemnity on consumers, is void.
  • Section 130: timely delivery of services, with prompt notice of unavoidable delay.
  • Section 131: goods that are reasonably suitable for their intended purpose, of good quality and free of defects.

The Act also shifts liability for defective goods towards a strict liability regime, which cannot be excluded or restricted by contractual terms. In other words, a supplier cannot rely on an agreement with a consumer to contract out of liability for defective goods. This reinforces the statutory protection available to consumers.

Enforcement is not merely theoretical. In July 2024, the FCCPC imposed a $220 million penalty on Meta and WhatsApp following a 38-month joint investigation with the NDPC into alleged discriminatory and exploitative practices. On 25 April 2025, the Competition and Consumer Protection Tribunal upheld the penalty, affirming the Commission’s authority to enforce consumer protection laws even in regulated sectors. The implication for service providers is clear: contractual terms and platform policies do not place businesses beyond the reach of statutory regulation. If Meta and WhatsApp could not rely on their terms of service to avoid regulatory accountability, local service providers should not assume that their own contractual arrangements will offer them any greater protection.

Why an NDA Is No Shield for Poor Service or Defective Products

A confidentiality agreement protects genuine secrets: source code, designs and internal metrics. The problem begins when it is stretched to cover the customer’s own experience of the service. Nigerian law gives at least five reasons why such a clause will not protect a provider from the consequences of poor service.

  1. It cannot waive statutory rights. Section 129 FCCPA voids terms that exclude liability for negligence or defective performance. A clause whose practical effect is to stop customers complaining about defects is the same exclusion clause dressed differently.
  2. It is an unfair term. A gag imposed on existing customers as a condition of continued service, with no negotiation and no decline option, sits squarely within section 127. Section 124’s bar on coercion and undue influence reinforces the point.
  3. It cannot silence regulators. The FCCPC, NDPC, sector regulators and the police act on complaints. A term that discourages reports of safety defects to the authorities is likely to be against public policy and unenforceable.
  4. Truth remains a defence. The law of defamation already protects a business from false statements. A non-disparagement clause that also bans true statements adds nothing legitimate and invites the conclusion that it exists to hide problems.
  5. It creates evidence against you. Where a dispute reaches a court or regulator, a gag clause can suggest the provider knew of risks and tried to keep them quiet. That is the opposite of reasonable care.

The experience with digital lending apps offers a cautionary lesson. Some digital lenders accessed customers’ contact lists and used the information to shame or harass borrowers who defaulted on loan repayments, relying on consent provisions buried in their app terms and conditions to justify the practice. Regulators, however, were not persuaded that such contractual consent legitimised the conduct. In 2021, NITDA fined Soko Lending ₦10 million for privacy violations. The FCCPC also worked with Google to restrict loan apps’ access to users’ contact lists. The lesson is clear: contractual fine print cannot legitimise an otherwise unlawful or unfair business practice.

Data Protection: Customers’ Data Is Not Your Intellectual Property

Essential services depend heavily on personal data: delivery addresses and pick-up points, account details, health records, meter readings and phone contacts. The NDPA requires such data to be processed lawfully, fairly and only to the extent necessary. It also grants data subjects rights of access, rectification and erasure, and the right to lodge complaints. These statutory rights cannot be contracted away. A clause claiming that any data a customer supplies becomes the provider’s exclusive property misunderstands the legal position. A data controller may hold and process personal data, but this does not confer unrestricted ownership or extinguish the rights of the data subject.

The Nigeria Data Protection Commission (NDPC) has demonstrated its willingness to enforce these obligations:

  • Fidelity Bank, ₦555.8 million (August 2024). A single data subject complained that their personal data had been used to open an account without a lawful basis. According to the NDPC, the bank had processed personal data without informed consent in critical instances and had relied on non-compliant third-party processors. Although the bank disputed the findings, the case demonstrates how an individual complaint can trigger a wider regulatory investigation.
  • MultiChoice Nigeria, ₦766.2 million (July 2025). The NDPC found that MultiChoice had engaged in intrusive processing of the data of subscribers and their associates, alongside unlawful cross-border data transfers. Citing the company’s lack of cooperation, the Commission imposed the full penalty and directed an audit of MultiChoice’s data collection channels.
  • Meta and WhatsApp, $220 million (upheld April 2025). The joint investigation by the FCCPC and NDPC further demonstrates the growing intersection between consumer protection and data protection enforcement, as well as the willingness of regulators to collaborate in addressing corporate misconduct.

The message for any service provider seeking to restrict customers’ data rights or prevent them from reporting security vulnerabilities is clear: data protection is a statutory obligation, not a matter of contractual convenience. Regulators are unlikely to accept contractual attempts to get around these obligations as a defence to non-compliance.

A Practical Compliance Checklist for Essential Service Providers

Responsible providers manage reputational risk by improving service delivery, not by restricting customer speech. Before launching a new product, beta programme or revised contractual terms, providers should consider the following:

  1. Make participation genuinely optional. Beta programmes and new contractual terms should include a clear option to decline, without depriving customers of access to their existing core services.
  2. Limit confidentiality obligations. Protect legitimate trade secrets and commercially sensitive information for a defined period, subject to standard exclusions for information already in the public domain and disclosures required by law.
  3. Remove blanket non-disparagement clauses. Where protection is necessary, restrict it to knowingly false statements rather than genuine criticism, adverse experiences or legitimate customer complaints.
  4. Include express regulatory exceptions. Make clear that nothing in the agreement prevents customers from reporting concerns to the FCCPC, NDPC, relevant sector regulators, the police, professional advisers or the courts.
  5. Accept responsibility for your obligations. Clearly state your commitments on safety, insurance, service standards and customer redress. Contractual arrangements that impose extensive obligations on customers while offering little protection in return may raise questions of unfairness.
  6. Conduct a Data Protection Impact Assessment (DPIA). Assess privacy risks before introducing products or services involving high-risk processing of personal data, and ensure that only information necessary for the intended purpose is collected.
  7. Bring onerous terms to customers’ attention. Highlight provisions affecting customers’ rights, remedies and liability in clear language before acceptance. Keep records showing how and when the terms were presented.
  8. Establish effective complaint channels. Acknowledge, investigate and resolve complaints within clearly defined timelines. Customers should not have to resort to social media to get a response from their service provider.
  9. Audit third-party processors and vendors. The Fidelity Bank investigation shows the importance of ensuring that third-party processors comply with data protection requirements. Outsourcing data processing does not remove a controller’s regulatory responsibilities.
  10. Engage regulators promptly and transparently. Cooperate with regulatory investigations, provide the information requested and address identified compliance gaps. The NDPC’s actions against Fidelity Bank and MultiChoice show the weight regulators give to cooperation and accountability.

Conclusion: Trust Is Earned in Service, Not Secured by Silence

Nigerian law has moved decisively from caveat emptor towards caveat venditor. The Supreme Court in Ngonadi set out the duty of care. The FCCPA turned it into statutory rights that cannot be waived. The NDPA made customers’ data a protected right rather than a corporate asset. The FCCPC, the NDPC and the Tribunal have shown, against Meta, MultiChoice and Fidelity Bank, that they will enforce those rights.

For essential service providers, the message is simple. If your service is good, customer feedback is your best marketing. If it is not, an NDA will not hide the defect, but it may turn a service problem into a legal one. Build products that can withstand honest reviews, and write terms that respect the law your customers already rely on.

This article is general information, not legal advice. For a review of your customer terms, beta agreements or data protection compliance, contact AEO Law Practice at info@aeolawpractice.com.

Written by Adeola Osifeko, LLB, BL, LLM, ACIS, ABR — Founding Partner, AEO Law Practice.

© AEO Law Practice 2026. All rights reserved.

Blog: http://www.aeolawpractice.blog |LinkedIn · Instagram: @AEO Law Practice X: @aeo_lawpractice

Sources

Discover more from The Legal Trove

Subscribe to get the latest posts sent to your email.

Unknown's avatar

Published by aeolawpractice

AEO is a corporate commercial and IP law firm, with indigenous practice experience and global outlook that serves your legal business/individual and causes. We are committed to building businesses and enabling individuals to THRIVE and SCALE sustainably, support causes that ELEVATES humanity and COLLABORATE with forward thinking Lawyers. Contact Adeola on +2348091336859or adeola@aeolawpractice.com

Leave a Reply