Lawful Basis Tracker

Overview

The Lawful Basis Tracker component helps organisations identify, document, and maintain records of the lawful basis for each data processing activity. Under the Nigeria Data Protection Act 2023 (NDPA), every processing of personal data must be grounded in a valid lawful basis as defined in Section 25.

Installation

Install the NDPR Toolkit package which includes the Lawful Basis Tracker components:

pnpm add @tantainnovative/ndpr-toolkit

Production Readiness

Use this checklist when moving Lawful Basis Tracker from demo mode into a customer-facing workflow. Pair the UI package with the source templates in @tantainnovative/ndpr-recipes so validation, persistence, and audit behavior live in your own backend.

Import

Import from the main package:

import { LawfulBasisTracker, useLawfulBasis } from '@tantainnovative/ndpr-toolkit';

// Utility functions
import {
  validateProcessingActivity,
  getLawfulBasisDescription,
  assessComplianceGaps,
  generateLawfulBasisSummary,
} from '@tantainnovative/ndpr-toolkit';

Components

The Lawful Basis Tracker provides a component and hook for managing lawful basis records:

import { LawfulBasisTracker, useLawfulBasis } from '@tantainnovative/ndpr-toolkit';

function LawfulBasisPage() {
  const { activities, addActivity, updateActivity, archiveActivity } = useLawfulBasis();

  return (
    <LawfulBasisTracker
      activities={activities}
      onAdd={addActivity}
      onUpdate={updateActivity}
      onArchive={archiveActivity}
    />
  );
}

API Reference

LawfulBasisTracker Props

Lawful Basis Types

// The six lawful bases for processing personal data per NDPA Section 25(1)
type LawfulBasis =
  | 'consent'              // Section 25(1)(a)
  | 'contract'             // Section 25(1)(b)
  | 'legal_obligation'     // Section 25(1)(c)
  | 'vital_interests'      // Section 25(1)(d)
  | 'public_interest'      // Section 25(1)(e)
  | 'legitimate_interests'; // Section 25(1)(f)

interface ProcessingActivity {
  id: string;
  name: string;
  description: string;
  lawfulBasis: LawfulBasis;
  lawfulBasisJustification: string;
  dataCategories: string[];
  involvesSensitiveData: boolean;
  sensitiveDataCondition?: SensitiveDataCondition;
  dataSubjectCategories: string[];
  purposes: string[];
  retentionPeriod: string;
  retentionJustification?: string;
  recipients?: string[];
  crossBorderTransfer: boolean;
  createdAt: number;
  updatedAt: number;
  reviewDate?: number;
  status: 'active' | 'inactive' | 'under_review' | 'archived';
  dpoApproval?: {
    approved: boolean;
    approvedBy: string;
    approvedAt: number;
    notes?: string;
  };
}

Lite variant (read-only)

For read-only surfaces such as dashboards and audit pages, use LawfulBasisTrackerLite from the new /lawful-basis/lite subpath. It renders the same list-and-summary view as the Full component without any Add, Edit, Archive, or CSV-export affordances — and ships at 12.7 KB instead of 36.7 KB (a 65% saving, minified and pre-gzip).

import { LawfulBasisTrackerLite } from '@tantainnovative/ndpr-toolkit/lawful-basis/lite';

<LawfulBasisTrackerLite
  activities={activities}
  onActivityClick={(activity) => router.push(`/lawful-basis/${activity.id}`)}
/>

See the Lite vs Full Managers guide for migration notes, side-by-side examples, and the full bundle-size table.

Best Practices

• Assess Before Processing: Determine and document the lawful basis before starting any new processing activity.
• Review Regularly: Periodically review lawful basis assessments, especially when the nature of processing changes.
• Be Specific: Do not rely on a blanket lawful basis for all activities; each processing purpose should have its own documented basis.
• Consent as Last Resort: Where another lawful basis applies, consider using it instead of consent, as consent can be withdrawn at any time.
• Keep Records: Maintain audit trails of all assessments for regulatory accountability under the NDPA.

Need Help?