INTRODUCTION

The maxim “actio personalis moritur cum persona”, meaning that a personal right of action dies with the person, has long served as the common law’s blunt instrument for extinguishing certain personal legal claims at death. Nigerian data protection law produces the same posture, albeit by default rather than by deliberate design. Section 65 of the Nigeria Data Protection Act 2023 (“NDPA”) defines “data subject” as “an individual to whom personal data relates” and defines “personal data as information tied to an “identified or identifiable” individual.  Neither definition says so in as many words, but the NDPA’s enforcement structure, particularly its framework of individual rights, complaints, and judicial redress, effectively excludes the dead by presupposing a living rights-holder capable of exercising those statutory rights. What follows biological cessation is, in the NDPA’s architecture, simply silence. That silence is now speaking at considerable volume.

On the morning of 31 July 2024, Nigerians woke to the news that the legendary singer, actress, and activist Onyeka Onwenu had died the evening before, collapsing shortly after a performance at a friend’s birthday party in Lagos.[1] Within days, articles began to surface cataloguing the “best-kept secrets” of her private life, detailing her unhappy marriage, which Onyeka had spent decades protecting, to the extent of only agreeing to be interviewed on the explicit condition that her personal life remain untouched.[2] She had guarded that information with the same intentionality with which one might guard a legal right.

She was not alone in this posthumous exposure. When the Nollywood comic genius John Okafor (popularly known as the beloved character – Mr. Ibu), died on 2 March 2024, within weeks of his death, his private family affairs became a public spectacle.[3] In February of same year, Nigerians were startled by the sudden and tragic helicopter crash that claimed the life of the prominent Herbert Wigwe, who at the time was the Group Managing Director of Access Bank, alongside his wife and son.[4] This tragedy eventually set in motion a very public dispute over his will and estate, with allegations of manipulation surfacing in press reports, resulting in the exposure of Herbert’s most intimate financial architecture and legacies exposed for public consumption and scrutiny.

Altogether, those are symptoms of a structural legal failure that has failed to protect the most sensitive personal data of natural persons after death. Nigeria’s data protection framework, anchored by the NDPA, is silent on what happens to personal data after death. This silence is a jurisprudential lacuna that demands urgent attention especially in this digital era, because the legal question it raises goes to the heart of something far more fundamental: who is a person, and when does personhood, and its attending rights truly end?

THE NDPA’S SILENCE AND WHAT IT PERMITS

The NDPA, signed into law by President Bola Ahmed Tinubu, creates enforcement mechanisms, and aligns Nigeria with global data protection standards. Its stated objectives include safeguarding the fundamental rights and freedoms of data subjects as guaranteed under the Constitution of the Federal Republic of Nigeria, 1999 (As Amended) (“the Constitution”), particularly Section 37, which guarantees the right to privacy.

However, a careful reading of the NDPA reveals a critical limitation: it defines a “data subject” exclusively in terms of a living natural person. Once death occurs, the statutory protections, therefore, dissolve inevitably. Accordingly, the personal data of the deceased, not excluding their medical records, financial information, private communications, relationship history, sex life, becomes legally unmoored. It becomes accessible to family members, classmates, colleagues, staff, journalists, social media users, and anyone with the means and inclination to surface it.

It should, however, be acknowledged that even where the NDPA applies to living data subjects, the right to privacy is not absolute. The Act recognises circumstances in which personal data may be processed without consent, including where processing is necessary for compliance with a legal obligation, the administration of justice, the performance of a task carried out in the public interest, the establishment, exercise or defence of legal claims, or for certain archival, scientific, historical research and statistical purposes, subject to appropriate safeguards. These recognised exceptions demonstrate that data protection law has always balanced privacy against competing societal interests. The difficulty in the posthumous context is not that such balancing exists, but that the NDPA provides no framework at all for undertaking it once the data subject dies.

This is not a uniquely Nigerian problem. The European Union’s General Data Protection Regulation (EU GDPR) similarly excludes the deceased from its scope, leaving the matter up to member states’ deliberation. France, for example, has enacted specific provisions under its Data Protection Act, allowing individuals to give instructions on the use of their data after death. Italy’s data protection authority has taken a similar position. These jurisdictions have recognised that the legal architecture cannot simply abandon the dead. Nigeria, with its rich cultural understanding of what death means, has stronger grounds to do the same, and a more urgent imperative. It bears noting that Nigerian courts have previously engaged with the interface between fundamental rights and post-mortem interests. As established in cases like Mrs. Precious Omonyahuy v. IGP,[5] the Court of Appeal accepts that fundamental rights can protect post-mortem interests, but it restricts this almost exclusively to violations under Section 33 (Right to Life), Section 34 (Dignity), and Section 35 (Personal Liberty) of the Constitution. The present question is a natural and necessary extension of that jurisprudential inquiry into the digital age.

A WISH DOES NOT DIE WITH THE BODY: THE PERSISTENCE OF PERSONAL AUTONOMY

Let us reason carefully from established principles. Nigerian law recognises that certain decisions made during a person’s lifetime may have legal consequences after death, particularly in relation to testamentary dispositions and the administration of estates. The law of succession is premised, in part, on this recognition. A testator may, subject to the applicable law of succession, determine how his estate is to be distributed after his death.

The logical question, therefore, presents itself with some force: if the law honours a dead man’s wish as to who inherits his farmland, why should it not give legal effect to his wish that his private medical diagnosis, his intimate relationships, or the contents of his personal correspondence remain unexposed? The distinction warrants examination. Both categories of wishes may be understood as expressions of personal autonomy. The difference in their legal treatment may reflect the historical development of data protection law rather than a coherent theory of posthumous autonomy.

Where a deceased person has expressly sought to keep particular information private during his/her lifetime, that conduct may provide evidence of his/her wishes concerning posthumous disclosure. Inductively, we may observe that in virtually every case where the data of a deceased Nigerian has been exposed, there is evidence, whether in the form of prior statements, conduct, or the very secretiveness with which he/she guarded the information during his/her lifetime, that he/she would not have consented to the exposure. Onyeka Onwenu’s explicit interview conditions, maintained for decades, were as clear a data-privacy instruction as any written directive. It is only that the law had no mechanism to give effect to it.

THE MORTUARY, THE COSMOLOGICAL, AND THE CONSTITUTIONAL

There is a practice, common across ethnic groups in Nigeria, of speaking to the deceased in the mortuary before the body is touched or prepared for burial. Elders address the dead directly. They seek permission whilst explaining what they are about to do to the deceased’s body. This is a profound cultural epistemology, a lived expression of the belief that personhood does not terminate at the cessation of biological functions.

By contrast, Western data protection frameworks, including those that influenced the NDPA, are grounded in a materialist conception of personhood in which death marks a clear legal termination of personality. On that view, rights cease entirely once life ends.

That position does not fully reflect Nigerian cosmological and cultural understandings of the human person. A legally responsive framework should account for that divergence. Nigerian jurisprudence, therefore, faces both an obligation and an opportunity to develop a distinctively African philosophical foundation for data protection, rather than relying exclusively on imported assumptions about the limits of personhood.

THE LIVING VICTIMS OF THE DEAD’S EXPOSURE

Even setting aside the philosophical question of post-mortem personhood, there is an argument of immediate and undeniable practical force: the exposure of a deceased person’s data causes direct, measurable harm to the living. The children of John Okafor (Mr. Ibu) did not choose for their family’s most painful disputes to become national entertainment. The sons of Onyeka Onwenu did not invite the public into their mother’s marriage. The surviving members of the Wigwe family did not consent to having estate litigation become a subject of press commentary.

The harm cascades across several dimensions:

• Reputational harm to surviving family members who bear the deceased’s name;
• Psychological trauma, particularly for minor children, from the public dissection of a parent’s private life;
• Financial prejudice, where exposure of estate disputes or financial irregularities affects ongoing business relationships; and
• Social stigma arising from the revelation of health conditions, relationship histories, or lifestyle choices.

The NDPA’s existing framework protects third-party data where it intersects with a living data subject’s processing. But it provides no protection where the primary subject is deceased and the collateral harm falls on the living. This gap must be closed.

TOWARD A LEGISLATIVE FRAMEWORK: PRACTICAL PROPOSALS

The Nigeria Data Protection Commission (“NDPC”), as constituted under the NDPA and further guided by the General Application and Implementation Directive (“GAID”) issued in March 2025, has an important institutional role to play in developing and implementing safeguards for personal data, but the substantive protection of deceased persons would require legislative intervention. We, therefore, propose the following as bases for amendment of the NDPA and, where appropriate, subsequent regulatory implementation:

• A statutory right for individuals to designate a “Data Executor”, analogous to an executor of a will, whose function is to manage, restrict access to, or direct the deletion of the deceased’s personal data.
• A default period of post-mortem data protection, subject to legislative prescription and periodic review, during which the personal data of a deceased person may not be processed except with the consent of a designated personal representative, under statutory authority, or pursuant to a court order.
• An express prohibition on the commercial exploitation of a deceased person’s sensitive personal data, including health data, sexual or relational data, and financial data, without lawful authority.

• Recognition, within the NDPA through legislative amendment, of the cultural dimension of Nigerian personhood, such that courts and the NDPC may take into account evidence of a deceased person’s privacy wishes as expressed during their lifetime.

CONCLUSION

The silence of the Nigeria Data Protection Act on posthumous privacy is more than a technical omission. It is a legal and philosophical gap with profound human consequences. As recent events involving public figures demonstrate, the death of an individual increasingly marks the beginning of unrestricted exposure of their most private information. Yet Nigerian law already recognises that certain wishes survive death through wills, estate administration, and burial directives. There is therefore no principled reason why privacy wishes should receive lesser protection.

Beyond philosophy, the consequences are practical and immediate. The exposure of a deceased person’s data often inflicts reputational, emotional, and financial harm on surviving relatives. Nigeria now has an opportunity to develop a distinctly African approach to data protection, one that reflects both constitutional values and cultural understandings of personhood. The law must evolve to recognise that while life may end, dignity, autonomy, and privacy interests do not necessarily die with the body.