On 11 June 2026, the Federal High Court of Abuja handed down judgment in the case Abdulmalik Muhd v. Guaranty Trust Holding Company Plc (GTCO). Presiding judge Obiora Egwuatu ruled that financial institutions shall not send unsolicited marketing SMS to non‑customers.
The court held that GTCO’s dispatch of “Fund 724” product marketing SMS to non‑customers breached Section 36 of the Nigeria Data Protection Act (NDPA) as well as constitutional privacy provisions. The judgment took formal effect on 30 June 2026. GTCO was ordered to pay NGN 250 000 in compensatory damages to the claimant. Violations may attract maximum sanctions of NGN 10 million fine or 2 % of annual turnover.
This is not an isolated ruling and demonstrates the Nigerian judiciary’s strict stance against unsolicited commercial communications. In a separate related matter, the Abuja High Court ordered Stanbic IBTC Bank to pay NGN 15 million damages to two former customers. The bank retained and processed their personal data and kept delivering promotional messages even after account closure. That judgment was issued 29 July 2026.
These two cases illustrate that Nigerian courts are actively enforcing the NDPA alongside constitutional privacy rights to sanction financial‑institution data misuse for marketing purposes. When conducting A2P‑SMS marketing, financial institutions must strictly differentiate existing customers from non‑customers and only transmit marketing content to users who have provided explicit consent.
