Customer Data and Body Measurements Under the Nigeria Data Protection Act

Fashion brands handling customer data and body measurements under the Nigeria Data Protection Act should collect only what they need, tell customers why they collect it, and keep it secure. The Act is overseen by the Nigeria Data Protection Commission (NDPC), which was established under the Nigeria Data Protection Act 2023.

Tailors, boutiques and online stores handle a lot of personal information: names, phone numbers, delivery addresses, photos and detailed body measurements. This guide shows you how to handle it responsibly in a busy fashion business. If you sell online, our guide to virtual try-on for African fashion brands explains how shoppers check fit before ordering.

This is general information, not legal or tax advice. Speak with a lawyer or a data protection professional about your specific situation.

What does the NDPC say about businesses that collect data?

The NDPC's website explains that under Section 29 of the Act, a data controller must ensure the methods by which data is collected are strictly in line with the principles of data protection. A data controller is, in simple terms, the business that decides why and how personal data is used. For a fashion brand, that is usually you.

The NDPC site also offers registration for data controllers and processors, and publishes information on data controllers and processors of major importance. Check the NDPC website to see whether registration applies to your business. Don't assume either way.

Why are body measurements sensitive for a fashion brand?

Body measurements describe a real person's body. Linked to a name and phone number, they say a lot about someone. Customers trust you with them, often without thinking twice.

Treat measurements with care because:

• They're personal. Bust, waist and hip figures can be private to many people.
• They're often shared on WhatsApp, where chats are easy to forward by mistake.
• They're kept for years so you can sew repeat orders.
• Photos sent for fittings may show a customer's face and body.

Handle them as personal data, even if you only use them to sew a kaftan.

What data should a fashion brand collect?

Collect only what you need for the order. Here is a practical checklist.

Data	Do you need it?	Good practice
Name and phone	Yes, to contact and deliver	Save in one business record
Delivery address	Yes, for delivery	Don't post it in group chats
Body measurements	Yes, for custom or fitted orders	Store in one secure place
Full-length photos	Sometimes, for fit checks	Delete when no longer needed
Date of birth	Rarely	Only if you send birthday offers and the customer agrees
ID documents	Almost never	Avoid collecting

If you can't say why you need a field, don't collect it.

How should you tell customers what you do with their data?

Be clear and short. A simple privacy notice on your website and a line on WhatsApp go a long way.

Explain:

1. What you collect. For example, measurements, phone number and address.
2. Why. To sew, deliver and contact you about your order.
3. Who sees it. Your tailors and your delivery rider, for example.
4. How long you keep it. For example, while you remain a customer, so repeat orders fit.
5. How to ask for changes. Give a phone number or email.

For marketing broadcasts, ask before adding customers, and let them opt out easily. Our guide to building a customer list for a boutique shows how to collect details respectfully.

How do you keep measurement records secure?

Small habits reduce most risks:

• Use one system, not a mix of notebooks, chats and screenshots.
• Lock your phone and the apps that hold customer data.
• Limit access. Staff see only what they need for their work.
• Remove old photos from shared phones and chat groups.
• Back up to a secure account, not a shared laptop in the workshop.
• Act fast if something goes wrong. If a phone is stolen or data leaks, change passwords and seek advice on what to do next.

What about customers abroad?

If you sell to diaspora customers, you may handle data about people in the UK, US or elsewhere, and data may travel across borders. Ask your adviser what applies. Our guide to NEPC registration basics covers the export side of selling abroad.

If you're still setting up your business structure, our guide to choosing a CAC business name or limited company helps you decide which registration fits.

How should online stores explain try-on and sizing tools?

If your store offers virtual try-on or a body scan, tell shoppers what happens to their photo and measurements. Our guide to explaining shopper privacy for virtual try-on covers what to say on your product pages.

ZeDaq.ai gives tailors and designers one place for client records: a client CRM, measurements collected through a link the client opens on their own phone, orders and invoices, in the ZeDaq Business app for iOS and Android. That helps you move measurements out of scattered chats. Every paid plan has a 3-day free trial with no card required.

FAQs

Who enforces the Nigeria Data Protection Act?

The Nigeria Data Protection Commission, established under the Act. Its website at ndpc.gov.ng has guidance and registration information.

Do I need to register with the NDPC?

The NDPC offers registration for data controllers and processors. Check its website or ask an adviser whether it applies to your business.

Can I keep a customer's measurements after their order?

Many customers expect you to keep them for repeat orders. Tell them you keep them, explain why, and delete them if asked, subject to your adviser's guidance.

Is it safe to collect measurements on WhatsApp?

Chats are easy to forward and hard to organize. Move measurements into one secure record and delete copies you no longer need.