Under the Nigeria Data Protection Act (NDPA) 2023, companies can process personal data without consent by relying on alternative lawful bases under Section 25 or specific exemptions under Section 3, ensuring processing remains necessary, proportionate, and documented.
Alternative Lawful Bases (Section 25)
- Processing necessary for contract performance or pre-contract steps with the data subject.
- Compliance with a legal obligation binding the controller or processor.
- Protection of vital interests of the data subject or another person.
- Tasks in the public interest or exercise of official authority.
- Legitimate interests of the controller or third party, subject to a balancing test via Legitimate Interests Assessment (LIA).
Key Exemptions (Section 3)
- Personal or household activities, provided they respect privacy rights.
- National security, defense, or public safety by competent authorities.
- Prevention, detection, investigation, or prosecution of crimes.
- Public health emergencies or protection of public health.
- Journalism, public interest publications, research, or artistic/literary purposes where incompatible with data rights.
