Section 25 Nigeria Data Protection Act 2023

Section 25 of the Nigeria Data Protection Act 2023 is about Lawful basis of personal data processing. It is under Part V (Principles and Lawful Basis Governing Processing of Personal Data) of the Act.

(1) Without prejudice to the principles set out in this Act, data processing shall be lawful, where —
(a) the data subject has given and not withdrawn consent for the specific purpose or purposes for which personal data is to be processed ; or

(b) the processing is necessary —
(i) for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract,
(ii) for compliance with a legal obligation to which the data controller or data processor is subject,

(iii) to protect the vital interest of the data subject or another person,
(iv) for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller or data processor, or
(v) for the purposes of the legitimate interests pursued by the data controller or data processor, or by a third party to whom the data is disclosed.

(2) Interests in personal data processing shall not be legitimate for the purposes of subsection (1)(b)(v), where —
(a) they override the fundamental rights, freedoms and the interests of the data subject ;
(b) they are incompatible with other lawful basis of processing under subsection (1)(b) (i)-(iv) ; or
(c) the data subject would not have a reasonable expectation that the personal data would be processed in the manner envisaged.