Follow Us on Google
Nigeria has taken another significant step towards strengthening data privacy and regulatory compliance with the launch of the second phase of the Legal Basis Project, a pioneering initiative designed to bridge the gap between data protection laws and their practical implementation under the Nigeria Data Protection Act (NDP Act) 2023.
The unveiling of Legal Basis Project 2.0 took place during a Regulatory Engagement Session in Abuja, where regulators, policymakers, technology experts, legal professionals and other stakeholders reaffirmed their commitment to building a stronger data protection ecosystem that safeguards the rights of individuals while promoting responsible data processing practices.
The initiative seeks to ensure that organisations, regulators and data processors move beyond policy aspirations to practical compliance by adopting lawful and accountable approaches to collecting, storing and processing personal data.
Participants at the engagement stressed the need for a robust regulatory framework capable of protecting citizens’ privacy while ensuring that organisations handling personal information comply fully with the provisions of the Nigeria Data Protection Act.
The session attracted representatives from several key government institutions and regulatory agencies, including the Nigeria Data Protection Commission (NDPC), National Human Rights Commission (NHRC), Central Bank of Nigeria (CBN), Medical Laboratory Science Council of Nigeria, Nigeria Revenue Service (NRS), National Identity Management Commission (NIMC), Securities and Exchange Commission (SEC), Federal Ministry of Justice and the Federal Competition and Consumer Protection Commission (FCCPC), among others.
Stakeholders expressed satisfaction with the achievements recorded during the first phase of the project and pledged continued collaboration to establish effective safeguards that protect data subjects while ensuring greater accountability among organisations responsible for processing personal information.
The Legal Basis Project, developed and implemented by Tech Hive Advisory with support from Meta, was created to simplify and operationalise the six lawful bases for processing personal data as outlined in the Nigeria Data Protection Act 2023. The project was first launched in the Federal Capital Territory on October 13, 2025.
The six recognised lawful bases include Consent, Contract Necessity, Legal Obligation, Legitimate Interest, Vital Interest and Public Interest. According to the project developers, these principles provide the legal foundation upon which organisations can process personal data responsibly while protecting the rights of individuals.
The initiative emerged against the backdrop of increasing global concerns over the limitations of relying solely on consent as the primary basis for data processing. As international data protection standards continue to evolve, Nigerian organisations are increasingly expected to adopt more comprehensive legal frameworks that promote transparency, accountability and compliance.
Speaking at the event, Meta’s Director of Privacy and Data Policy for Africa, the Middle East and Turkey, Dr. Ololade Shyllon, described collaboration with regulators and industry stakeholders as essential to the project’s long-term success.
She commended participants for their commitment throughout the first phase and urged regulators and organisations to focus on implementing the recommendations that emerged from the project’s initial assessment.
Highlighting the impact of the first phase, Shyllon disclosed that within six months of its launch, the platform attracted 4,360 unique visitors from 72 countries. It also generated more than 1.58 million video views and reached approximately 1.6 million people through various digital channels.
Other News
According to her, the encouraging figures demonstrate that accessible and compliant data protection infrastructure is achievable in Nigeria, while also revealing significant compliance gaps that require urgent attention.
She explained that findings from the first-phase survey showed that although awareness of data protection principles has increased considerably, many organisations still struggle to properly document their legal basis for processing data or comply fully with the regulatory requirements.
According to Shyllon, awareness alone is insufficient unless it is translated into concrete actions that strengthen compliance and accountability.
Moderating the engagement session, Emerging Technologies and Policy Lead and Co-founder of Tech Hive Advisory Africa, Ridwan Oloyede, said the second phase of the project represents a deliberate shift from understanding the law to implementing it effectively across organisations and institutions.
He noted that sustained engagement between regulators, policymakers and private sector stakeholders would remain critical to ensuring the successful implementation of Nigeria’s data protection framework.
Oloyede explained that the project is designed to close existing knowledge gaps, improve understanding of the Nigeria Data Protection Act and align local compliance practices with international best practices.
He added that lessons from the first phase clearly demonstrated a growing demand among organisations for accessible compliance infrastructure capable of supporting regulatory obligations.
According to him, Legal Basis Project 2.0 introduces several practical tools aimed at simplifying compliance processes and helping organisations meet increasingly stringent regulatory requirements.
Among the newly introduced features is an automated suite of compliance solutions developed specifically for the Nigeria Data Protection Act and the General Application and Implementation Directive (GAID) framework.
The upgraded platform includes a Legal Basis Audit Tool that enables organisations to identify compliance gaps and generate structured reports for regulatory purposes. It also features a guided Record of Processing Activities (RoPA) Builder designed to help organisations document data processing workflows more effectively.
Also included is a Legitimate Interest Assessment (LIA) Builder, which assists organisations in determining whether legitimate interest can lawfully serve as the basis for processing personal data under the Act.
To further support compliance, the platform introduces a Basis Switching Checker that helps organisations determine when changing the legal basis for processing data is permissible, alongside a Privacy Notice Generator that simplifies the preparation of transparent privacy notices.
The project also features an interactive Legal Basis Finder and an artificial intelligence-powered chatbot known as Paddy, which provides organisations and compliance teams with instant guidance on data protection obligations and regulatory requirements.
Stakeholders expressed optimism that the expanded capabilities introduced under Legal Basis Project 2.0 will significantly improve compliance levels, strengthen institutional accountability and deepen public confidence in Nigeria’s evolving data protection ecosystem.
They agreed that continued collaboration among regulators, technology firms, legal practitioners and policymakers will be essential to ensuring that Nigeria’s data protection framework remains effective, globally competitive and responsive to emerging digital challenges.
