The Nigeria Data Protection Act, 2023 ("NDPA" or the
"Act") aims to establish a stable, uniform and conducive
regulatory framework for individuals and organisations involved in
data processing operations, either as businesses dealing with
personal information of natural persons within their target markets
("entities") or as clients and prospects of the various
businesses ("data subjects").
Legitimate interest is one of the lawful bases recognized under
the NDPA for which entities may process personal data. This is a
recent development as Legitimate Interest was not among the five
lawful bases recognized under the Nigeria Data Protection
Regulation ("NDPR") for processing of personal data. The
inclusion of legitimate interest by the NDPA brings the
country's data processing regime in line with international
best practices and increases the lawful bases for processing of
personal data from five to six.
