A recent report indicates that Substack, the newsletter publishing platform, experienced a data breach exposing users’ email addresses and phone numbers.
“It’s only contact information.”
That assumption is legally flawed.
Under #data protection law, personal data includes any information that identifies or can identify an individual. Email addresses and phone numbers clearly qualify. They are direct identifiers and fall within the scope of statutory protection.
The absence of financial data does not eliminate legal exposure.
Once disclosed, contact information can facilitate phishing schemes, SIM swap fraud, social engineering attacks, and identity profiling. These risks heighten the legal consequences of a #breach because regulators assess both the nature of the data and the potential harm arising from its exposure.
The key legal question is not simply what data was accessed.
It is whether the organisation complied with its statutory obligations.
Did it implement appropriate technical and organisational measures as required by law?
Was there a lawful basis for processing the data?
Were processors properly bound by data protection agreements?
Were breach notification thresholds triggered?
Were affected data subjects informed where required?
Under modern data protection regimes, both controllers and processors may face administrative penalties, enforcement directives, and reputational consequences.
The defence that an entity is “only a platform” or “just a processor” does not automatically shield it from scrutiny. Liability increasingly travels across the data ecosystem.
For Nigerian #businesses, the Nigeria Data Protection framework imposes clear duties: implement safeguards, maintain processing records, ensure lawful processing, and notify regulators of qualifying breaches.
Regulators are no longer satisfied with policy statements. They examine evidence of compliance.
Data protection is a statutory obligation.
It is not a public relations exercise.
