Essentials of the Legitimate Interest Assessment (LIA) under the Nigeria Data Protection Act 2023

Legitimate interest is the most flexible of the six lawful bases for processing personal data under section 25 of the Nigeria Data Protection Act 2023 (NDPA). It is also the most frequently misused. Because it does not depend on consent or a legal obligation, organisations sometimes treat it as a convenient default. In Nigeria, it should not be one.

Section 25(1)(b)(v) of the NDPA permits processing that is necessary for the legitimate interests pursued by the data controller or data processor, or by a third party to whom the data is disclosed. Section 25(2) then limits that basis. Legitimate interest cannot be relied on where the controller’s interests override the fundamental rights, freedoms and interests of the data subject, where it is incompatible with the other lawful bases in section 25(1)(b), or where the data subject would not reasonably expect the processing given the relationship with the controller.

The Act does not define “legitimate interest” and does not use the term “Legitimate Interest Assessment.” The Nigeria Data Protection Commission (NDPC) filled that gap in the General Application and Implementation Directive 2025 (GAID). Article 26 of the GAID requires a controller to consider reliance on legitimate interest cautiously and to show the basis of its preference in a compliance audit. Schedule 8 supplies an LIA template. Together with the accountability principle in section 24 of the Act, this means that an organisation unable to show its reasoning will struggle to defend its reliance on this basis before the Commission.

The LIA is therefore the documented record of a weighing exercise. In Nigeria it is also a regulatory expectation.

The Nigerian Context: Why This Basis Is Treated with Caution

Three features of the Nigerian framework distinguish it from the GDPR model on which many practitioners were trained.

A consent-first posture. Article 17 of the GAID encourages controllers to prioritise informed consent as the expression of informational self-determination. It also provides that reliance on any lawful basis other than consent, where it is not supported by the Special Rule of Law Indexes (SRLI) listed in Article 17(3), will be strictly scrutinised during compliance audits and in any proceeding where the controller’s conduct is questioned. Those indexes include the risk to fundamental rights, public welfare, the prior relationship between the parties, and the proportionality and necessity of the processing.

A list of processing that requires consent. Article 18(1) provides that consent is required for direct marketing, for the processing of sensitive personal data, for further processing incompatible with the original purpose, for the processing of a child’s data, for transfers to countries without an adequacy decision, and for decisions based solely on automated processing that have legal or similarly significant effects. In practice, much of what GDPR-trained practitioners would run through a legitimate interest analysis cannot be placed on this basis in Nigeria.

A constitutional frame. The NDPA gives effect to the right to privacy guaranteed by section 37 of the 1999 Constitution. The GAID reminds controllers that no processing is authorised without regard to sections 37 and 45 of the Constitution, and that the necessity and proportionality of processing, the alternatives forgone, and the duty of care owed to data subjects must be evaluated (Article 23). The LIA is where that evaluation is recorded for processing that rests on legitimate interest.

The Three-Part Test

The NDPA does not set out a three-stage test in terms. The structure below follows section 25(2) of the Act and Article 26 and Schedule 8 of the GAID, and it corresponds to the test applied by the Court of Justice of the European Union (CJEU) and by regulators such as the UK Information Commissioner’s Office. Foreign decisions are persuasive rather than binding in Nigeria. Schedule 1 of the GAID does, however, direct that Nigerian precedents on rights enforcement that respect the advancement of fundamental freedoms in other jurisdictions be favourably considered, and Article 35 recognises the Legitimate Interest Assessment as an interoperable data privacy measure that may be benchmarked against global practice. A sound LIA addresses each stage separately.

1. The Purpose Test: Is there a legitimate interest?

Identify what you are trying to achieve and why it matters. The interest must be:

• Lawful. Article 20 of the GAID requires every processing purpose to be lawful under the NDPA, not in violation of other legislation in force in Nigeria, and not in breach of peremptory norms of international law. Section 24(1)(b) of the Act separately requires purposes that are specified, explicit and legitimate.
• Sufficiently clear and specific. “Improving our business” is too vague. “Detecting and preventing fraudulent card transactions on our payment platform” is specific enough to assess.
• Real and present. Not speculative.

The NDPA has no recital listing examples. Practitioners therefore look to comparative sources such as Recital 47 of the GDPR, which recognises fraud prevention, network and information security, and intra-group administrative transfers. These are persuasive guides, and they travel reasonably well to Nigerian settings such as fraud detection by banks and fintechs, securing networks and systems, internal administration within a corporate group, and establishing or defending legal claims. The CJEU has confirmed that a wide range of interests, including commercial ones, can qualify (Rīgas satiksme, C-13/16; KNLTB, C-621/22), and that the interest may belong to a third party. A commercial interest is not automatically legitimate, however. It must still pass the next two stages.

Direct marketing deserves a specific warning. Under Article 18(1)(a) of the GAID, consent is required for any direct marketing activity. A controller should not treat marketing as a legitimate interest purpose in Nigeria.

2. The Necessity Test: Is the processing necessary?

The processing must be genuinely needed to achieve the stated purpose. This is where many LIAs fail. Ask:

• Does the processing actually advance the purpose?
• Is there a less intrusive way to reach the same result?
• Could you use less data, anonymised or pseudonymised data, or a shorter retention period?

If a reasonable alternative achieves the aim with less impact on individuals, the processing is unlikely to be necessary. The data minimisation principle in section 24 of the Act is closely tied to this stage. Article 23(1)(a) of the GAID directs that the necessity of processing be evaluated with regard to the risks and the alternatives forgone, and Article 26(2)(b) specifically requires controllers relying on legitimate interest to prioritise privacy by design and by default, including the suitability of anonymisation or pseudonymisation. On retention, Article 49(3) provides that where no period is fixed by law, storage should lapse not later than six months after the original purpose has been accomplished, subject to the exceptions in Article 49(4).

3. The Balancing Test: Do individuals’ interests override yours?

This is the core of the assessment. You weigh your interest against the impact on the people whose data you process. Relevant factors include:

• Nature of the data. Sensitive personal data attracts additional safeguards under the NDPA, and Article 18(1)(b) of the GAID requires consent for its processing. Financial data, location data, government-issued identifiers such as the NIN, and children’s data also carry greater risk. Section 31 of the Act protects children and persons lacking capacity to consent.
• Reasonable expectations. Section 25(2) of the NDPA makes this a statutory limit. Would a typical data subject in Nigeria, given the context and the relationship, expect this processing? Processing that surprises people is difficult to justify.
• Likely impact. Consider both positive and negative effects, including loss of control, discrimination, financial harm, distress, chilling effects on behaviour, and the risk of profiling. Article 26(2)(d) of the GAID requires controllers to identify and eliminate processing that overreaches the rights of data subjects, particularly processing that may lead to behavioural monitoring, profiling, or targeted advertising by third parties or partners. Article 42(5) adds an assessment of disparate outcomes.
• Vulnerability. Children, and other vulnerable individuals, are owed particular care. Schedule 6 of the GAID provides Data Subject Vulnerability Indexes, and Article 27(1) requires that information be given clearly, with vulnerable data subjects in mind.
• Scale and manner. Large-scale, continuous or combined processing increases impact. Controllers designated as being of major importance under Article 8 of the GAID should expect closer scrutiny.
• Safeguards. Measures that reduce impact tilt the balance in your favour. Examples include clear transparency, an accessible route for objection, prompt remediation of data subjects’ rights (Article 26(2)(g)), strong security, short retention periods, pseudonymisation, and human review of automated decisions.

When Legitimate Interest Is Not Available, or Is Not Enough

Legitimate interest does not displace other requirements. In Nigeria, the following points are the most important.

• Statutory exclusions. Section 25(2) of the NDPA removes the basis where the controller’s interests override the data subject’s rights, where it is incompatible with the other lawful bases, or where the processing is outside the data subject’s reasonable expectations.
• Consent-mandatory processing. The categories in Article 18(1) of the GAID, set out above, require consent. Legitimate interest cannot substitute for it.
• Cookies and similar tracking tools. Article 19 of the GAID requires consent for the use of cookies other than strictly necessary cookies, and extends the same rules to comparable tracking tools. Nigeria has no separate ePrivacy statute, but the GAID reaches the same result.
• Sharing with third parties. Article 41(9) of the GAID states that where data is shared with third parties, explicit consent must be obtained from the data subject. A controller proposing to rely on legitimate interest for disclosures to partners should treat this provision as a serious obstacle and take advice before proceeding.
• Public bodies. The NDPA does not contain a GDPR-style prohibition on public authorities relying on legitimate interest. Public bodies are nonetheless more naturally served by the legal obligation and public interest bases, which carry the safeguards in Articles 22 and 25 of the GAID and the constitutional tests in section 45 of the 1999 Constitution.
• Sector rules. Regulators such as the Central Bank of Nigeria and the Nigerian Communications Commission impose their own requirements. These apply alongside the NDPA, and section 63 of the Act provides that the NDPA prevails where they are inconsistent with it.

Practical Implications

Transparency. Under section 27 of the NDPA and Article 27(3) of the GAID, the information given to data subjects must include the lawful basis of processing, the purpose, the types of data collected, third-party access, data subject rights, the route to internal remediation, and the right to lodge a complaint with the Commission. A privacy notice that says “legitimate interest” without describing the interest falls short of this standard.

Right to object. Part VI of the Act gives data subjects the right to object, and section 36 applies to processing based on legitimate interest and to direct marketing. Under Article 38(1)(c) of the GAID, a data subject may also seek erasure where they have objected to processing based on legitimate interest and no overriding ground exists for continuing. Build the objection route into your processes before you rely on the basis.

Documentation before processing. Article 26(2)(a) of the GAID makes it mandatory to carry out the LIA before embarking on the processing, and to identify and document the compatible lawful basis (Article 26(2)(c)). Name the decision-maker. Record the outcome in the Record of Processing Activities. The Data Protection Officer’s semi-annual report must address the LIAs applicable to the organisation’s processing (Article 13(5)(f)), and the DPCO verifying the compliance audit will expect to see them. Article 12 of the GAID requires that the DPO be able to perform these tasks free of pressure or influence.

Review and linkage to the DPIA. Keep the LIA under review as circumstances, technology or data uses change. Where processing is likely to result in high risk, section 28 of the Act requires a Data Privacy Impact Assessment (DPIA). Article 28(3) of the GAID lists circumstances in which a DPIA is mandatory and must be filed with the Commission, including profiling, systematic monitoring, sensitive or highly personal data, vulnerable data subjects, financial services delivered through digital devices, health care, e-commerce and educational services. A DPIA is vetted and signed by a DPO certified by the Commission. The LIA should feed into it.

A Simple LIA Structure

Schedule 8 of the GAID sets out the Commission’s LIA template, and controllers should complete that template. A workable internal structure, consistent with it, includes:

1. Description of the processing and its context
2. Identification of the interest and whose interest it is
3. Necessity analysis, including alternatives considered
4. Balancing analysis covering data type, reasonable expectations, impact and vulnerability
5. Safeguards and mitigations adopted
6. Confirmation that the processing falls outside the consent-mandatory categories in Article 18 of the GAID
7. Outcome, sign-off by the accountable officer and DPO, and review date

Conclusion

An LIA is not a box-ticking exercise but a structured argument, and it is only as credible as its honesty. In Nigeria it is also evidence. Registration, audit returns, DPIAs and LIAs are the documents the Commission will ask for when a complaint is investigated, and the GAID treats a controller’s compliance record as prima facie good faith, though not a substitute for concrete evidence in its defence (Article 48).

A strong assessment is specific, tests genuine alternatives, considers the individual’s perspective, and concludes in favour of the controller only when the evidence supports it. Given the Nigerian emphasis on consent, the statutory limits in section 25(2), and the constitutional right to privacy in section 37, the better course where the balance is close is to add safeguards, narrow the processing, or choose a different lawful basis, which in many cases will be consent.