ARTICLES

CBN Rules on Digital Lending and Data Privacy in Nigeria

Digital lending has opened access to quick loans for millions of Nigerians, but it also created serious concerns about privacy abuse, harassment and misuse of personal information. To protect borrowers, the Central Bank of Nigeria (CBN) and other regulatory bodies introduced rules that every digital lender must follow. These rules apply to loan apps, online lending platforms and fintech companies that collect user data during loan applications, verification or recovery.

This article explains CBN requirements on data privacy, borrower protection, information security and digital lending conduct. Anyone using loan apps or operating a lending platform needs to understand these standards to avoid violations and penalties.

Legal Backing for Digital Lending Rules

The CBN works with agencies such as:

Federal Competition and Consumer Protection Commission (FCCPC)
Nigeria Data Protection Bureau (NDPB)
Economic and Financial Crimes Commission (EFCC)
Nigerian Communications Commission (NCC)

These agencies enforce rules on data security, loan recovery practices, customer consent and digital identity protection. Loan apps must also align with the Nigeria Data Protection Regulation (NDPR) and the Consumer Protection Framework issued by the CBN.

Consent Before Data Collection

Loan apps are not permitted to collect personal data without permission. Users must be informed before any access is granted to:

Contacts
Call logs
Photos
Messages
Device information
Location data
BVN
Email addresses

Borrowers must see a privacy notice that explains why their data is needed and how it will be used.

Restriction on Third-Party Data Sharing

CBN guidelines forbid unauthorized sharing of user information with external parties. Loan apps cannot transfer or sell personal data to:

Marketers
Ad networks
Offshore companies
Agents without approval

Only licensed partners involved in credit checks or payment processing may access data when necessary.

Limits on Contact Access

Many unregulated apps force users to approve contact access and later harass friends, colleagues and family members. The CBN categorizes this act as privacy abuse. Approved loan apps must:

Avoid accessing contact lists by default
Request only relevant permissions
Avoid mass messaging or defamatory broadcasts
Delete any unwanted data

Rules Against Harassment and Defamation

Digital lenders are not allowed to intimidate or blackmail users. The CBN and FCCPC ban practices such as:

Threat messages
Public shaming on WhatsApp or Facebook
Calls to employers and relatives
False accusations of fraud
Use of fake enforcement agents

Borrowers have the right to report such abuse along with screenshots and recordings for investigation.

Accurate Loan Terms and Data Use Disclosure

CBN requires digital lenders to provide full disclosure before loan approval. Apps must clearly state:

Interest rate
Repayment date
Total payable amount
Penalties
Applicable charges
Data use policy

Users should not be tricked into clicking “accept” without understanding the consequences.

Security of BVN and Financial Data

The CBN allows digital lenders to verify borrowers through BVN, but only with consent. No loan app should:

Request ATM pins
Ask for online banking passwords
Demand OTP codes
Store sensitive card details carelessly

BVN is strictly for identity confirmation, fraud prevention and loan eligibility checks.

Storage and Encryption Requirements

Digital platforms must protect stored data using strong encryption and cybersecurity systems. Databases must prevent unauthorized access, leaks or exposure. The following data should be secured:

Names
Bank details
Loan history
BVN
Address
Employment information
Device identifiers

CBN-approved lenders must also appoint data officers to ensure compliance.

Data Retention and Deletion Rules

Loan apps are required to keep personal data only as long as it is needed. When a borrower completes repayment or closes their account, the lender must delete unnecessary information. Users can request removal of their details, provided there is no ongoing legal or financial obligation.

Limits on Data Collected From Borrowers

Borrowers are protected against excessive data requests. Legitimate apps only collect what is needed for credit evaluation. Requests beyond identification, repayment details and financial background are not acceptable. Loan platforms cannot demand access to:

Photo galleries
Microphones
Social media login credentials
File storage

Any lender demanding such permissions is likely unregulated.

Complaint Systems for Borrowers

CBN rules mandate digital lenders to provide working complaint channels. Users should be able to reach the lender through:

Phone lines
Email support
In-app chat
Official website

When complaints are ignored, borrowers can escalate them to the CBN Consumer Protection Department or the FCCPC.

Debt Recovery Guidelines

Loan apps must use ethical recovery procedures. Approved methods include:

SMS or email reminders
Calls to the borrower only
In-app notifications
Structured repayment plans
Legal action when necessary

Unlawful recovery methods can lead to fines, app removal and license revocation.

Mandatory Registration With Authorities

The FCCPC requires digital lenders to apply for approval under the enforcement framework governing online lending. Platforms must provide:

Company name
License details
Contact address
Ownership information
Information handling procedures

Loan apps that refuse or fail to register face shutdown or legal action.

No Upfront Charges Without Transparency

Regulated platforms do not demand hidden processing fees or upfront payments. All charges must be visible before disbursement. Users should avoid apps that request money before loan approval.

Privacy Policy Display

CBN expects loan apps to display a privacy policy clearly within the app or website. The policy should explain:

Data collection
Usage purpose
Sharing practices
Security safeguards
Contact channels

Any app hiding this information is suspicious.

Public Accountability and Traceability

Approved lenders have a traceable office address, functioning support lines and a visible brand identity. Anonymous apps cannot meet CBN standards. Borrowers should check:

Company registration name
FCCPC registration
CBN licensing partner
Website and application details

Penalties for Data Privacy Violations

Loan apps that violate data privacy rules or lending conduct guidelines risk:

Monetary fines
License suspension
App store delisting
Account freezing
Criminal prosecution
Blacklisting
Public exposure by regulators

Digital lenders found guilty of harassment or defamation are also subject to compensation claims.

Protection of Sensitive Information During Disputes

Disagreements between borrower and lender must be resolved without data exposure. Loan platforms cannot leak photos, addresses or contact lists as part of recovery efforts.

Importance of These Rules

These rules safeguard borrowers from exploitation and help build trust in digital finance. Platforms that respect privacy enjoy better user retention and fewer legal troubles. Borrowers benefit from fair treatment and safer access to credit.