Lawful Basis for Processing

Introduction

The Nigeria Data Protection Act 2023 (NDPA) requires that every processing of personal data must be based on a valid lawful basis. This guide explains the six lawful bases available under the NDPA, how to determine which basis applies, and how to use the NDPR Toolkit to document your decisions.

The Six Lawful Bases Under NDPA 2023

Section 25 of the NDPA 2023 establishes six lawful bases for processing personal data:

How to Determine the Right Lawful Basis

1. Identify the purpose: Clearly define why you need to process the personal data.
2. Consider the context: Look at the nature of the data, the relationship with the data subject, and the expectations of the data subject.
3. Evaluate each basis: Work through the six lawful bases and identify which one genuinely applies. Do not simply default to consent if another basis is more appropriate.
4. Document your decision: Record the chosen lawful basis and your reasoning using the Lawful Basis Tracker component.
5. Inform data subjects: Include the lawful basis in your privacy notice for each processing purpose.

Using the Lawful Basis Tracker

The NDPR Toolkit provides the LawfulBasisTracker component and useLawfulBasis hook to guide you through the assessment process:

import { LawfulBasisTracker, useLawfulBasis } from '@tantainnovative/ndpr-toolkit';

function LawfulBasisPage() {
  const { activities, addActivity, getSummary } = useLawfulBasis();

  return (
    <LawfulBasisTracker
      activities={activities}
      onAddActivity={addActivity}
      summary={getSummary()}
    />
  );
}

Common Scenarios

Related Resources