Lawful Basis Tracker
Track and document the lawful basis for every data processing activity under NDPA 2023
Overview
The Lawful Basis Tracker component helps organisations identify, document, and maintain records of the lawful basis for each data processing activity. Under the Nigeria Data Protection Act 2023 (NDPA), every processing of personal data must be grounded in a valid lawful basis as defined in Section 25.
NDPA Section 25 — Lawful Basis for Processing
The NDPA 2023 requires that personal data shall only be processed if at least one of the following applies: consent of the data subject, performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a task carried out in the public interest, or legitimate interests of the controller (subject to the rights of the data subject).
Installation
Install the NDPR Toolkit package which includes the Lawful Basis Tracker components:
pnpm add @tantainnovative/ndpr-toolkitImport
Import from the main package:
import { LawfulBasisTracker, useLawfulBasis } from '@tantainnovative/ndpr-toolkit';
// Utility functions
import {
validateProcessingActivity,
getLawfulBasisDescription,
assessComplianceGaps,
generateLawfulBasisSummary,
} from '@tantainnovative/ndpr-toolkit';Components
The Lawful Basis Tracker provides a component and hook for managing lawful basis records:
LawfulBasisTracker
A comprehensive component for tracking and documenting the lawful basis for each data processing activity. It provides a UI for adding, editing, and reviewing processing activities with their associated lawful basis.
import { LawfulBasisTracker, useLawfulBasis } from '@tantainnovative/ndpr-toolkit';
function LawfulBasisPage() {
const { activities, addActivity, getSummary } = useLawfulBasis();
return (
<LawfulBasisTracker
activities={activities}
onAddActivity={addActivity}
summary={getSummary()}
/>
);
}API Reference
LawfulBasisTracker Props
| Prop | Type | Default | Description |
|---|---|---|---|
| processingActivity | ProcessingActivity | Required | The processing activity to assess |
| onComplete | (result: LawfulBasisResult) => void | Required | Called when the assessment is completed |
| onSave | (draft: Partial<LawfulBasisResult>) => void | undefined | Called when a draft is saved |
| initialBasis | LawfulBasisType | undefined | Pre-selected lawful basis for editing |
Lawful Basis Types
type LawfulBasisType =
| 'consent'
| 'contract'
| 'legal_obligation'
| 'vital_interest'
| 'public_interest'
| 'legitimate_interest';
type ProcessingActivity = {
id: string;
name: string;
description: string;
dataCategories: string[];
dataSubjects?: string[];
purpose?: string;
};
type LawfulBasisResult = {
activityId: string;
basis: LawfulBasisType;
justification: string;
assessedAt: string;
reviewer?: string;
notes?: string;
};Best Practices
- Assess Before Processing: Determine and document the lawful basis before starting any new processing activity.
- Review Regularly: Periodically review lawful basis assessments, especially when the nature of processing changes.
- Be Specific: Do not rely on a blanket lawful basis for all activities; each processing purpose should have its own documented basis.
- Consent as Last Resort: Where another lawful basis applies, consider using it instead of consent, as consent can be withdrawn at any time.
- Keep Records: Maintain audit trails of all assessments for regulatory accountability under the NDPA.