Reimagining Nigeria’s Data Protection Landscape: The Legal Basis Project’s Impact on the Digital Economy
By Joshua Olomu
Ongoing discussions about the legal framework surrounding data protection in Nigeria’s rapidly evolving digital economy have gained substantial momentum. Stakeholders emphasise the need to establish robust data protection laws to cultivate digital trust, a cornerstone for unlocking the nation’s potential in digital identity and the broader digital economy.
This focus culminated in the enactment of the Nigeria Data Protection Act (NDP Act) 2023, which establishes a formal legal framework for safeguarding personal data, ensuring accountability, and promoting citizens’ digital rights.
This groundbreaking legislation replaces previous regulations, addresses long-standing legal gaps, and establishes the Nigeria Data Protection Commission (NDPC), a regulatory body dedicated to enforcing the Act. However, a significant challenge has arisen: an overreliance on consent as the primary legal basis for data processing, which has complicated the effective implementation of the NDP Act 2023.
In light of this, the Legal Basis Project was initiated to improve awareness and practical application of the NDP Act 2023 among organisations, regulators, and users alike. Launching officially on October 13, 2025, in Abuja, this initiative aimed to clarify the provisions of the NDP Act 2023. Spearheaded by Tech Hive Advisory with support from Meta, the project brought together a diverse group of participants, including policymakers, legal experts, technology professionals, media representatives, and regulators from the NDPC and related agencies.
Phase One Impact Report
The first report from the Legal Basis Project, released six months after its launch, showcases significant achievements. The platform attracted 4,360 unique visitors from 72 countries, garnered over 1.58 million views of its video content, and reached approximately 1.6 million individuals across various digital platforms. An interactive game designed to educate users on data protection principles recorded a low bounce rate of 41%, well below the platform’s overall average of 84%.
These results indicate that engaging educational tools can effectively capture users’ attention. The report underscores that the project’s foundation was built upon rigorous research. Before creating any resources, two structured focus group discussions were held with representatives from the Nigeria Data Protection Commission, the National Human Rights Commission, the Nigerian Communications Commission, and the Federal Competition and Consumer Protection Commission, as well as private-sector compliance experts, civil society advocates, students, and regular technology users.
Emerging from these discussions was a shared concern: consent has become the default method for data processing in Nigeria, not necessarily because it is appropriate, but rather due to a pervasive lack of understanding of alternative legal options. This conclusion was further supported by a survey of over 300 respondents, which revealed that 74% believed organisations defaulted to consent, assuming it was sufficient for all forms of processing.
Furthermore, 69% indicated that it was essential for organisations to communicate their legal bases clearly, yet 56% noted that such explanations were seldom provided, highlighting a notable disconnect between user expectations and the information offered.
The project team observed that platform usage reflected their design choices: the consent guide was the most-visited page, while the Privacy Notice Builder had a 0% bounce rate. Eighteen partner organisations incorporated the platform’s resources into their outreach initiatives.
Collaborative efforts with the Nigeria Data Protection Commission also broadened the platform’s impact on university campuses and community programs. A particularly successful Data Protection Week event in Ibadan attracted nearly 1,000 secondary school students in just one day.
Impact in Numbers
Analytics from the recent reporting period reveal substantial growth, particularly around the launch, fuelled by community involvement and media attention. Nigeria accounted for a remarkable 75.8% of the total traffic, with the remaining 24.2% originating from the global community, including the Nigerian diaspora and international data protection experts who discovered the platform through organic search and social media.
Notable international visitors came from the United States, the United Kingdom, Canada, the Netherlands, and Ireland. German users exhibited deep engagement, spending an average of more than 21,000 seconds on the platform, which equates to about 6 minutes per visitor. This level of interaction underscores the relevance and quality of the content provided. The platform’s reach extended across the African continent, attracting users from 17 countries, including Ghana, Kenya, South Africa, Sierra Leone, Togo, Cameroon, Benin, and Gambia.
*Joshua Olomu writes from Abuja