What counts as sensitive
A common misconception needs correcting first. Under GDPR Article 9, the prohibition on special-category data covers biometric data processed for the purpose of uniquely identifying a natural person. A waist circumference is not biometric data. Height, weight, chest and hip measurements are anthropometric data, and the purpose qualifier is what decides.
Measurements alone are not special-category. Infer health status from them — BMI thresholds, waist-to-hip risk categories — and that inference becomes health data, which changes your obligations.
The Nigerian position
Nigeria's governing instrument is the Nigeria Data Protection Act 2023, enforced by the Nigeria Data Protection Commission. It is worth being precise here, because two things get repeated constantly and both are wrong: the Act is from 2023, not 2019, and registration is with the NDPC, not NIBSS NCA. The 2019 document is the Nigeria Data Protection Regulation, issued by the former NITDA.
Under the Act, consent must be demonstrable, freely given, and subjects must be informed of their right to withdraw before granting it. Silence and pre-ticked boxes do not count. For sensitive personal data, Section 30 requires explicit consent — a higher standard than ordinary consent.
Data Controllers of Major Importance must register with the Commission within six months. The threshold is processing personal data of more than 200 subjects in six months, or carrying out commercial information activities. Penalties under Section 48 reach the greater of ₦10,000,000 or 2% of annual gross revenue.
What you should be able to ask any measurement app
- Is my raw photo retained, or deleted after processing?
- Do you use my measurements to train models?
- Can I export or permanently delete my data?
- Who are the processors, and where are they located?
- Do you infer health information from my measurements?
Practical rules
Photos are the most sensitive thing in the pipeline. A measurement can be deleted; a photograph cannot be un-taken. If an app lets you skip image retention, take that option. Prefer tools that tell you plainly what they store.
If you are building this yourself, the right default is to process the images, extract the numbers, discard the pixels, and say so in plain language. Users who understand the tradeoff make better decisions than users asked to consent to everything at once.