In a bid to bridge the gap between policy intent and practical compliance in order to effectively safeguard the fundamental rights of data subjects and promote data processing practices that prioritise security and the rights of others, in line with the Nigeria Data Protection Act (NDP Act) 2023, phase two of the Legal Basis Project (2.0) has been unveiled.
The unveiling was done at a Regulatory Engagement Session for the project in Abuja, bringing together regulators and other key players in the digital economy ecosystem.
The stakeholders also harped on the need for a robust protection framework that ensures regulators and processors respect the rights and privacy of data subjects.
The session brought together key industry regulators from the public sector, as well as technology and legal experts, including representatives of the Nigeria Data Protection Commission (NDPC), National Human Rights Commission (NHRC), Central Bank of Nigeria (CBN), Medical Laboratory and Science Council of Nigeria and the Nigeria Revenue Service (NRS).
Other stakeholders present at the interactive session include representatives of the National Identity Management Commission (NIMC), the Securities and Exchange Commission (SEC), the Federal Competition and Consumer Protection Commission (FCCPC) and the Federal Ministry of Justice, among others.
While commending the successful completion of phase one of the project (1.0), the stakeholders expressed a commitment to establishing a robust mechanism to safeguard personal data, ensure accountability of data processors and regulators, and provide effective protection for data subjects beyond mere consent.
The Legal Basis Project – an innovative data protection campaign, developed and executed by Tech Hive Advisory, with the support of Meta, was initiated with a clear mandate of making the six lawful bases under the Nigeria Data Protection Act (NDP) 2023 understandable and actionable for organisations, regulators, and everyday users who interact with the legal basis platform, with phase one launched on October 13, 2025 in the FCT.
The six Legal Bases under the NDP Act include Consent, Contract Necessity, Legal Obligation, Legitimate Interest, Vital Interest and Public Interest.
The project came at a moment when the global conversation about the structural limits of consent as a data protection mechanism was reaching maturity, and what Nigerian organisations were doing by default, the rest of the world had already been forced to confront.
In her welcome address, Dr Ololade Shyllon, Meta Director, Privacy & Data Policy, Africa, the Middle East, and Turkiye, said collaboration with regulators was a critical part of the Legal Basis Project, and therefore commend stakeholders for identifying with it, adding that it was time to work towards implementing the recommendations from the survey carried out in the first phase of the project, as she lauded its landmark impact report within six months of its launch.
“In less than six months of its launch, the platform received 4,360 unique visitors from 72 countries, generated over 1.58 million video views, and reached an estimated 1.6 million people across digital channels.
“I will say that phase one is something that I find important as it ensures that accessible and compliant infrastructure in Nigeria is real and measurable, but it also reveals that there are big gaps.
“The survey revealed that knowing is not the same thing as doing. A user who identified a critical basis, then made no effort to document it, provide evidence for it, or do anything within the framework of a compliant architecture around it. So, the journey ended when the compliance journey needed to begin,” she said.
While moderating the sessions, Ridwan Oloyede, Emerging Technologies and Policy Lead and Co-founder, Tech Hive Advisory Africa, said that with phase one of the project completed, there was a need to move from understanding the law to implementing it, which demands consistent engagement with regulators and stakeholders.
According to him, the project seeks to address existing knowledge gaps, align the understanding of Nigerian data protection laws with international best practices, and help everyone in the ecosystem understand how the law applies.
He said that within six months of phase one’s launch, the project team conducted a survey to address existing knowledge gaps, align understanding of Nigerian data protection laws with international best practices, and help everyone in the ecosystem understand how the law applies.
Oloyede noted that phase one of the project has demonstrated real and measurable demand for accessible compliance infrastructure in Nigeria.
He, however, stressed that Legal Basis 2.0 is geared towards moving the platform from awareness to execution: full compliance document generation, guided assessments, consent quality scoring, audit tools, and a structured regulatory engagement programme with Nigeria’s key data protection bodies.
“With adequate support, the project will bridge existing knowledge gaps, align understanding of the Nigerian data protection laws with international best practices and as well help everyone in the ecosystem understand how the law applies,” he said.
According to him, to help organisations navigate these tightening regulatory demands, the platform has launched an automated suite of compliance tools tailored to the NDP Act and GAID frameworks,
He added that the newly unveiled updates include a Legal Basis Audit Tool to identify compliance gaps and generate structured reports, a guided RoPA Builder to map data workflows, and an LIA Builder to conduct Legitimate Interest Assessments.
Oloyede further explained that to address complex operational changes, the upgrade also introduces a Basis Switching Checker and a Privacy Notice Generator, supported by an interactive Legal Basis Finder and a conversational Chatbot named Paddy, designed to provide teams with instant, on-demand compliance guidance.