The Nigeria Data Protection Regulation makes a distinction between ‘personal data’ and ‘sensitive personal data’.

'Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’). 

In its most basic definition, sensitive data is a specific set of “special categories” that must be treated with extra security. These categories are:

• Racial or ethnic origin; 
• Political opinions; 
• Religious or philosophical beliefs; 
• Trade union membership; 
• Genetic data; and 
• Biometric data (where processed to uniquely identify someone). 

• A contract with the individual: for example, to supply goods or services they have requested, or to fulfil an obligation under an employee contract. 
• Compliance with a legal obligation: when processing data for a particular purpose is a legal requirement. 
• Vital interests: for example, when processing data will protect someone’s physical integrity or life (either the data subject’s or someone else’s). 
• A public task: for example, to complete official functions or tasks in the public interest. This will typically cover public authorities such as government departments, schools and other educational institutions; hospitals; and the police. 
• Legitimate interests: when a private-sector organisation has a genuine and legitimate reason (including commercial benefit) to process personal data without consent, provided it is not outweighed by negative effects to the individual’s rights and freedoms. 
• Consent: when the data subject agrees to the processing when presented with a clear explanation of the personal data that will be collected and what it will be used for.