Nigerian companies can rely on six lawful bases under Section 25 of the Nigeria Data Protection Act (NDPA) for processing personal data, mirroring global standards like GDPR.
The Six Lawful Bases
- Consent: Freely given, specific, informed, and unambiguous agreement from the data subject, often requiring opt-in mechanisms.
- Contract: Processing necessary to perform a contract with the data subject or take steps prior to entering one, such as fulfilling orders.
- Legal Obligation: Required to comply with a legal duty, like tax reporting or anti-money laundering rules.
- Vital Interests: Essential to protect the life or vital interests of the data subject or another person, typically in emergencies.
- Public Task: Necessary for tasks in the public interest or official authority vested in the controller.
- Legitimate Interests: Processing needed for the controller’s or a third party’s legitimate interests, balanced against data subject rights via a Legitimate Interests Assessment (LIA); not applicable to sensitive data.
Companies must document the chosen basis for each activity, prioritize non-consent bases where possible, and reassess if circumstances change
