Evaluate whether legitimate interest is an appropriate lawful basis for your data processing activities under the Nigeria Data Protection Act.
Make the basis defensible.
Relevant provisions under the Nigeria Data Protection Act and GAID.
NDPA / SECTION 25
Section 25 of the NDPA Act - Lawful Basis for Processing
Processing of personal data is lawful if the processing is necessary for the purposes of a legitimate interest pursued by the data controller or by a third party to whom the data is disclosed, except if such interest is overridden by the interest of the data subject relating to the protection of their fundamental rights and freedoms.
GAID Regulation Requirements (Article 26(2)(a))
Three questions. One clear decision.
A practical framework for explaining your reasoning with confidence.
A Legitimate Interest Assessment (LIA) is a structured evaluation that helps organisations determine whether they can lawfully rely on “legitimate interest” as a legal basis for processing personal data. The assessment involves a three-part test:
1
Purpose test
Identify the legitimate interest being pursued. Is it lawful, clearly articulated, and real (not speculative)?
2
Necessity test
Is the processing necessary to achieve the interest? Could you achieve the same result with less data or a less intrusive approach?
3
Balancing test
Do the individual's interests, rights, or freedoms override your legitimate interest? Consider the impact on data subjects.
When to conduct an LIA.
Legitimate interest is context-dependent. Use this as a starting point, not a substitute for judgment.
Common legitimate interest scenarios
- Direct marketing to existing customers
- Fraud prevention and detection
- Network and information security
- Internal administrative purposes
- Processing employee data for HR purposes
- Intra-group data transfers
When it may not apply
- Processing sensitive personal data
- Processing children's data
- When consent is more appropriate
- Public authorities performing official tasks
- Processing that causes significant harm
- When data subjects have no reasonable expectation