---
title: "Nigeria — Lawful Processing & Special Data | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/nigeria/lawful-processing-and-special-data/
source_html: /jurisdictions/nigeria/lawful-processing-and-special-data/index.html
description: "Nigeria — Lawful Processing & Special Data: lawful_processing_and_special_data Lawful Processing & Special Data 4 sub-modules 4 claims Amber ▾ # Core lawful-basis and consent framework is in force, but detailed sub-regulator"
generated_at: 2026-10-25T04:46:50Z
content_sha256: d51f2d318fc4e319d25df849c716a11838e7d8f5d82b7cd9ff865edd9128f030
generator: "fe-fleet/md-twin@1.0"
---
# Nigeria — Lawful Processing & Special Data | Data Protection Monitor

### D2Lawful Processing & Special Data4 sub-modules4 claimsAmber▾#

Core lawful-basis and consent framework is in force, but detailed sub-regulatory guidance on special categories, pseudonymisation/anonymisation safe-harbours and precise child-consent mechanics is not yet confirmed as published.

Primary framework Nigeria Data Protection Act, 2023 (NDPA), Part V

Supervisory authority [Nigeria Data Protection Commission (NDPC)](https://ndpc.gov.ng/)

Traffic-light rationale — Amber Core lawful-basis and consent framework is in force, but detailed sub-regulatory guidance on special categories, pseudonymisation/anonymisation safe-harbours and precise child-consent mechanics is not yet confirmed as published.

#### Sub-modules (4)

#### Lawful BasesGreen

Lawful bases include consent, legal obligation, contract, vital interest, and public interest.

Claims (1):

- NDPC relies on and recognises lawful bases for data processing such as consent, legal obligation and contract, consistent with NDPA Part V provisions on lawful basis of personal data processing.

#### Consent ThresholdsGreen

Consent must be evidenced in writing, orally, electronically, or through other action demonstrating the data subject's knowledge and agreement.

Claims (1):

- A data controller must seek consent either in writing, orally, through electronic means or by any other action through which the data subject knows he is giving consent.

#### Special CategoriesAmber

Sensitive personal data is addressed under Section 30 NDPA; GAID Article 28(8) imposes DPIA obligations for software processing sensitive data.

Claims (1):

- A data controller or processor that deploys software for processing sensitive personal data must carry out a DPIA and submit it to the Commission within four months, per GAID Article 28(8).

#### Pseudonymisation And AnonymisationRed

No specific pseudonymisation/anonymisation safe-harbour provisions were located in this research pass.

Category narrative 89 words

The NDPA (Part V, Sections 24-33) establishes principles and lawful bases for processing including consent, contract, legal obligation, vital interest and public interest. Consent must be freely given and evidenced in writing, orally, electronically or by other clear action. Sensitive personal data is addressed under Section 30, and processing of data belonging to children or persons lacking legal capacity to consent is addressed under Section 31, though granular thresholds (e.g., exact minimum age, verification mechanics) are not yet fully elaborated in public NDPC guidance located in this research pass.

Evidence 4

Sources and claims (4)
- Probable[NDPC](https://ndpc.gov.ng/) — NDPC relies on and recognises lawful bases for data processing such as consent, legal obligation and contract, consistent with NDPA Part V provisions on lawful basis of personal data processing.observed 2026-08-07
- Probable[NDPC](https://ndpc.gov.ng/faqs/) — A data controller must seek consent either in writing, orally, through electronic means or by any other action through which the data subject knows he is giving consent.observed 2026-08-07
- Probable[NDPC](https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf) — A data controller or processor that deploys software for processing sensitive personal data must carry out a DPIA and submit it to the Commission within four months, per GAID Article 28(8).observed 2026-08-07
- Uncertain[NDPC](https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf) — No confirmed statutory or GAID-level pseudonymisation/anonymisation safe-harbour definitions were identified for NG in this research pass.observed 2026-08-07