Nigeria Launches Phase 2 of the Legal Basis Project to Strengthen Data Protection Compliance
In alignment with the Nigeria Data Protection Act of 2023 (NDP Act), the second phase of the Legal Basis Project (2.0) has been unveiled, designed to translate policy intentions into actionable compliance. This initiative aims to safeguard the fundamental rights of data subjects while enhancing data processing practices that prioritize security and privacy.
The announcement was made during a regulatory engagement session held in Abuja, which convened key regulators and stakeholders from Nigeria’s digital economy. This gathering underscored the urgency for a robust protective framework that ensures both regulators and data processors honor the rights and privacy of data subjects.
The event attracted a diverse group of industry regulators from the public sector, along with technical and legal experts. Notable attendees included representatives from the Nigerian Data Protection Commission (NDPC), the National Human Rights Commission (NHRC), the Central Bank of Nigeria (CBN), and the Nigerian Medical Institute and Scientific Council.
Other participants in this interactive session comprised the National Identity Management Commission (NIMC), the Securities and Exchange Commission (SEC), the Federal Competition and Consumer Protection Commission (FCCPC), and the Federal Department of Justice. The collaboration among these entities emphasizes the shared commitment to establishing strong mechanisms for data protection.
While acknowledging the successful completion of Phase 1, stakeholders expressed their determination to implement effective practices that not only ensure accountability among data processors and regulators but also significantly enhance the protection of data subjects beyond mere consent. This initiative is crucial as public consciousness around data privacy continues to escalate globally.
The Legal Basis Project, an innovative data protection campaign developed by Tech Hive Advisory with support from Meta, seeks to demystify the six legal grounds outlined in the Nigeria Data Protection Act. Launched with an aim to make these legal bases understandable and actionable for organizations and everyday users, Phase 1 commenced on October 13, 2023, in the Federal Capital Territory.
The six legal bases under the NDP Act include consent, contractual necessity, legal obligation, legitimate interest, vital interest, and public interest. As the global dialogue surrounding the limitations of consent as a data protection mechanism matures, this project arrives at a pivotal time, particularly as other nations grapple with challenges that Nigerian organizations are already navigating.
Insights from Industry Leaders on Data Protection Challenges
During the session, Dr. Olorade Silon, Director of Privacy and Data Policy for Africa, the Middle East, and Turkiye at Meta, addressed attendees on the importance of regulatory collaboration as part of the Legal Basis Project. He commended stakeholders for their engagement and highlighted the significant impact report produced within six months of the project’s launch. Dr. Silon emphasized that now is the time to implement the research findings from Phase 1.
In the first six months since its launch, the project platform attracted 4,360 unique visitors from 72 countries and achieved over 1.58 million video views, with an estimated reach of 1.6 million people through various digital channels. Dr. Silon remarked on the necessity of an accessible and compliant infrastructure in Nigeria, while also pointing out the major gaps that remain.
Ridwan Oloyede, Head of Emerging Technologies and Policy at Tech Hive Advisory, moderated the session and stressed the importance of transitioning from understanding the law to enforcing it. He noted that ongoing engagement with regulators and stakeholders is vital for this shift. Oloyede outlined that the project aims to bridge knowledge gaps and align Nigeria’s data protection laws with international best practices.
He indicated that the first phase demonstrated a clear demand for compliance infrastructure in Nigeria. Moving forward, Legal Basis 2.0 aims to enhance the platform’s focus on execution, incorporating full compliance documentation, guided assessments, consent quality scoring, audit tools, and a structured regulatory engagement program with Nigeria’s leading data protection authorities.
Oloyede elaborated on the introduction of automated compliance tools designed to align with the NDP Act and the GAID framework, helping organizations meet increasingly stringent regulatory demands. Among the new updates are a legal basis audit tool to identify compliance gaps, a guided RoPA builder for data workflow mapping, and a legitimate interest assessment builder.
To address the complexities of operational changes, the upgrade will also feature a Basis Switching Checker and a Privacy Notice Generator, supplemented by an interactive Legal Basis Finder and an AI-driven chatbot named Paddy, offering on-demand compliance guidance to teams navigating these regulatory challenges.
