As Nigerians increasingly participate in the digital economy landscape, tech experts and other stakeholders have called for a robust protection framework to ensure accountability and the protection of citizens’ digital rights.

They made the call at the launch of The Legal Basis Project on Monday, 13 October 2025, in Abuja, stressing that there is a need to safeguard the fundamental rights of data subjects, regulate the processing of personal data, and promote data processing practices that prioritise security and privacy.

The Legal Basis Project, an innovative data protection initiative, is developed and executed by Tech Hive Advisory, with the support of Meta.

The launch brought together policymakers, legal experts, tech players in the private sector, the media, and sectoral regulators, including representatives of the Nigeria Data Protection Commission (NDPC), to chart a common front for clarity on the legal basis for data processing to foster the ethos of compliance and accountability.

Other stakeholders present at the launch included representatives of the Central Bank of Nigeria (CBN), the Nigeria Communication Commission (NCC), the Federal Competition and Consumer Protection Commission, the National Identity Management Commission (NIMC), the Medical Laboratory and Science Council of Nigeria, and members of relevant civil society groups, law firms, media, academia, and think tanks.

The stakeholders explored lawful basis dynamics that allow businesses to collect and use data, focusing on thematic areas such as consent, contract performance, compliance with legal obligations, protection of concerned interests, and the processing of data for public interest and other legitimate interests.

In his keynote address, Mr Solomon Musa Odole, Project Coordinator, Nigeria Identification for Development (IDAD) Project, lauded Tech Hive Advisory for the visionary initiative.

He said the project seeks to enhance understanding of the legal basis for data processing in the simplest way possible, such as reading simple articles, visualising complex issues, and playing the games. The people can have access to all of these via legalbasis.ng.

According to him, “This project represents not just another addition to Nigeria’s growing data protection ecosystem, but a strategic intervention that goes to the very heart of lawful data processing and accountability.

He noted that, “In today’s digital economy, data is often described as the new oil, but unlike oil, data’s value is not extracted from the ground; it is derived from trust—trust that our information will be used lawfully, fairly, and for legitimate purposes. This trust depends on one critical element: the legal basis for processing personal data.

“Whether we process data for public service delivery, for commercial transactions, or for research and innovation, our legitimacy rests on understanding and applying the correct legal basis.

“Yet, as we all know, this is easier said than done. Across sectors, we see confusion about which legal basis applies in a given context: consent where public interest should apply, legitimate interest invoked without proper balancing, or contractual necessity stretched beyond its intent.”

Odole said the Legal Basis Project was conceived in response to the growing need for a clear understanding of the concept of the legal grounds for processing personal data under the Nigeria Data Protection law, a homegrown Nigeria Data Protection Act.

He noted that “over the past few months, the team behind it has collaborated with experts from government, industry, youths, academia, civil society, law firms, the media, and everyday data subjects to develop practical tools and resources that will help clarify the legal bases for data processing and foster a culture of compliance and accountability.”

Ridwan Oloyede, Emerging Technologies and Policy Lead and Co-founder, Tech Hive Advisory Africa, said Nigerians need not be left behind as societies become rapidly digital, adding that there is a need for clear legal direction for data protection.

According to him, the Legal Basis Project seeks to address existing knowledge gaps, align understanding of the Nigerian data protection laws with international best practices, and also help everyone in the ecosystem understand how the law applies.

“The idea of the project is basically to bring information closer to people, make it more meaningful, make it more actionable, but also ensure people are empowered through knowledge, so they can make better-informed decisions.

“Everybody in the ecosystem—from the regulators themselves to the policymakers, to the everyday data subjects, people in the markets, in stores, people who sell, people who do grocery, folks in academia, youth, and everybody generally—becomes a common stakeholder in this ecosystem.

“The key thing, really, when you talk about legal basis is generally just to get a sense of what the legal reason is: what is the legal explanation? What is the legal justification for using people’s information in decision-making?” he said.

Oloyede emphasised that “what we’ve done with this project is to create a couple of toolkits, resources that can help organisations, people themselves, the everyday data subjects, the everyday Nigerian, to be more aware, to have a deeper understanding of what it is, but also, most importantly, to make better decisions now that they are fully empowered.”

He noted that although regulators have crucial roles to play, others in the ecosystem also have a role, “which is democratising access to this information, simplifying this information, making it more relatable, making it the reality that people actually deal with every day.”

According to him, through simple everyday realities, games, articles, visualisations, decision trees, and tools that help people write things like privacy notices, the project, with support from Meta, its principal partner, has made great progress in the data ecosystem.

Also, Toulu Akerele, Global Data Project Officer and ISMS Manager, Paystack Payment Limited, stressed the need for education on a lawful basis.

She said that, besides regulations, efforts should be channelled towards practical mass education so that everyone in the ecosystem instinctively understands that data use must have a legitimate and legal standing.

“I think awareness is something that we’ve seen missing when it comes to legal basis, even data protection in general; although the NDPC is doing a lot to raise awareness across the country, more still needs to be done.

“We had a lot of great conversations today, including different stakeholder engagements, and we looked at why consent seems to be incorrectly relied upon, especially with privacy policies.

“I think consent, when used properly, is a great tool. Companies should seek consent before sending direct marketing or targeted marketing emails, texts, phone calls, or anything like that.

“If you cannot use a service without consenting, that means consent is not the appropriate legal basis because it’s forced consent, it’s coerced consent, it’s not freely given.”

In his remarks, Kamfon Josephneke, Senior Legislative Aide to the President of the Senate, stressed the need for the implementation of legislation, policies, and regulations on data privacy and protection.

He therefore called for a multisectoral approach in ensuring that everyone in the ecosystem is well informed about the lawful usage of data.