A bowl of business cards is a database. So is a clipboard with 200 phone numbers on it, and so is every entry form your prize draw collected on Saturday.
Nigerian exhibitors spent years treating raffle entries as harmless fun. Under the Nigeria Data Protection Act 2023 they are personal data processed by you, for your purposes, under a law with real penalty bands and a regulator that enforces them.
None of this makes booth raffles illegal. It makes sloppy ones expensive.
This post is general information, not legal advice. If you process personal data at any scale, take advice from a Nigerian data protection practitioner and check the current guidance published by the Nigeria Data Protection Commission.
What the NDPA actually asks of you
The NDPA 2023 governs the processing of personal data in Nigeria and is enforced by the Nigeria Data Protection Commission. A name is personal data. So is a phone number, so is an email address. Collect any of them at your stand and you are a data controller.
The Act sets out six lawful bases for processing. For direct marketing — which is what you are doing when you collect numbers at a fair in order to call people about your product — consent is the usual basis. That means the consent has to be real.
What valid consent looks like
Under the NDPA, consent must be freely given, specific to each purpose, informed, unambiguous, and given by an affirmative action. Pre-ticked boxes do not count. Silence does not count. Neither does burying the permission inside terms nobody reads.
Translate that to a stand and it is quite practical.
| Not valid | Valid |
|---|---|
| A pre-ticked marketing box on the entry form | An unticked box the visitor taps themselves |
| "By entering you agree to receive our offers" in small print at the bottom | A separate, visible line the visitor actively agrees to |
| One tick covering the raffle, your newsletter and a partner's list | Separate permissions for separate purposes |
| Refusing to let someone spin unless they accept marketing | Entry into the draw, with marketing consent optional |
That last row is the one exhibitors resist, and it is the one that matters most. Consent is not freely given if the prize is conditional on it. You can require the details you genuinely need to run and award the prize. You should not make agreeing to future marketing the price of a spin. In practice this costs you almost nothing. The people who tick the optional box are the ones worth calling anyway.
Consent that was the price of a spin is not consent. It is a list you cannot safely use.
The notice you have to give
You must give people a clear privacy notice at the point of collection. Under the NDPA that notice needs to cover who you are, the lawful basis you are relying on, what you will use the data for, who else receives it, how long you will keep it, the rights the person has, and their right to complain to the NDPC.
At a stand, nobody is reading a page of legal text on their phone while a queue builds behind them. The workable pattern is layered: a short notice visible on the form itself, with a link to the full one on your website.
The rights you have to honour
Three matter most for exhibitors.
The right to object to direct marketing. This is a strong right under the NDPA. If someone tells you to stop calling or messaging, you stop, and you record that you stopped. Every marketing message should carry an obvious way out: "Reply STOP" on a WhatsApp broadcast, an unsubscribe link on email.
Withdrawal of consent. People can withdraw at any time, and withdrawing must be as easy as giving was. Practically: one email address a human monitors, and a way to mark a record as withdrawn in whatever you export your leads into.
Access, correction, erasure and restriction. Someone can ask what you hold on them, ask you to fix it, or ask you to delete it. You cannot answer any of those if your leads live on 200 damp paper slips in a box under someone's desk, which is one of the quieter arguments for digital capture over paper.
Retention: how long you keep the list
The Act expects you to keep personal data only as long as you need it for the purpose you collected it for. There is no magic number, so decide a period, write it down, put it in your notice, and delete on schedule.
Two sensible splits for fair leads. Raffle administration data is needed until the prize is awarded and any dispute window closes, so keep the period short and say so. Marketing consent data is needed while the consent is live; set a review period, and treat a contact who has ignored you for a year as a candidate for deletion rather than a permanent asset.
Deleting dead records is also good sales hygiene. Trade Show PRO's 2026 round-up reports that up to 80% of trade show leads never receive any follow-up, which means most exhibitors are hoarding data they will never use. That is legal exposure with no upside. The fix is a follow-up plan you actually run.
The penalties
Enforcement bands under the NDPA depend on what kind of controller you are.
| Category | Maximum penalty |
|---|---|
| Data controller of major importance | Up to ₦10 million or 2% of annual gross revenue, whichever is higher |
| Other data controllers and processors | Up to ₦2 million or 2% of annual gross revenue |
Individuals can also bring civil claims for damages, separately from anything the Commission does.
The realistic risk for an SME exhibitor is not a ₦10m fine landing on a Tuesday. It is a complaint from someone who kept getting messages after asking you to stop, and a regulator asking to see your consent records and your notice. Whether that goes well is decided months earlier, at the point of capture.
Copy this consent line onto your lead form
Two separate items. Do not merge them.
Required: I confirm my details are correct and I want to enter the prize draw run by [Company Name]. [Company Name] will use my details to run the draw and contact me if I win. See our privacy notice.
>
Optional, unticked: ☐ I agree that [Company Name] may contact me by phone, WhatsApp or email about its products and offers. I can withdraw this at any time by emailing [privacy@yourcompany.com].
A short privacy notice you can adapt
Put this on the form and link to the full version on your site. Replace everything in brackets.
Privacy notice. [Company Name] ([RC number]) is the data controller for the details you provide at this stand. We collect your name, phone number and email address to run this prize draw and, where you have separately consented, to contact you about our products.
>
Our lawful basis is your consent. We do not sell your data. We share it only with [our prize fulfilment partner / our lead capture provider], who process it on our behalf.
>
We keep prize draw entries for [X months] after the draw closes, and marketing contacts for [X months] from your last interaction with us.
>
You have the right to access, correct, delete or restrict your data, to object to direct marketing, and to withdraw your consent at any time by emailing [privacy@yourcompany.com]. You also have the right to lodge a complaint with the Nigeria Data Protection Commission.
>
Full notice: [yourcompany.com/privacy]
Adapt this with a practitioner rather than pasting it unchanged. It is a starting point, not a compliance programme.
Frequently asked questions
Do I need consent to collect emails at a trade fair in Nigeria?
For direct marketing purposes, yes. Consent is the usual lawful basis under the NDPA, and it must be freely given, specific, informed and given by an affirmative action such as ticking an unticked box.
Can I make marketing consent a condition of entering my booth raffle?
You should not. Consent is not freely given when the prize depends on it. Collect what you need to run the draw, and keep the marketing permission separate and optional.
What happens if I breach the NDPA?
Penalties run up to ₦10 million or 2% of annual gross revenue, whichever is higher, for a data controller of major importance, and up to ₦2 million or 2% for others. Individuals can also claim civil damages.
How long can I keep trade fair leads under the NDPA?
Only as long as you need them for the purpose you collected them for. Set a defined retention period, state it in your privacy notice, and delete on schedule.
Capture consent properly, at the point of the spin
Trade Shop currently has no dedicated marketing-consent field. It captures visitor details before the spin and keeps participant records exportable, but those records alone do not show marketing consent.
Launch a campaign — from ₦10,000 for up to 3 days, plus ₦1,000 per extra day.
Sources: Nigeria Data Protection Commission · NDPC — NDP Act GAID 2025 · CookieYes — Nigeria Data Protection Act (NDPA) · Trade Show PRO — Trade Show Statistics 2026