A Federal Capital Territory High Court has ordered Stanbic IBTC Bank to pay N15 million in damages to two former customers for unauthorized data processing. The court ruled that the bank infringed on the claimants’ privacy rights by continuing to send marketing communications after they had closed their accounts and withdrawn consent. This judgment highlights a shift in Nigeria’s data protection landscape, where individuals are increasingly using the courts to enforce privacy rights, moving beyond regulatory actions by the Nigeria Data Protection Commission. It serves as a precedent for organizations to audit their marketing databases and ensure data retention policies distinguish between statutory requirements and marketing use.