Consent under the Nigeria Data Protection Act (NDPA) 2023 is required as a lawful basis for processing personal data when no other basis (like contract or legal obligation) applies, particularly for marketing, non-essential cookies, or sensitive data without exemptions.
Key Scenarios Requiring Consent
Consent must be obtained explicitly for processing children’s data (under age thresholds, typically requiring parental/guardian verification) or individuals lacking legal capacity, unless vital interests, education, medical, or social care justify otherwise.
Websites and apps need opt-in consent before using non-essential cookies or tracking tools, per NDPC’s GAID Article 19.
Cross-border transfers to non-adequate countries often require explicit consent alongside safeguards.
When Consent Is Not Required
Companies can skip consent if processing relies on other bases like contractual necessity, legal obligations, vital interests, public tasks, or legitimate interests (with LIA for the latter).
Silence, pre-checked boxes, or bundling with contracts/services do not qualify as valid consent; it must be freely given, specific, informed, unambiguous, and withdrawable without affecting prior lawful processing.
