Filming Without Consent in Nigeria: Lawful Bases and Compliance Guide
In the world today, content is part of everyday life. From lively street scenes and bustling public transport stations, to breaking news coverage and viral social media reels, smartphones have made visual storytelling easy and ubiquitous. But as video content proliferates, legal questions about privacy and individual rights have become increasingly important.
Processing such data requires consent. However, the law also provides specific exceptions where consent is not strictly needed.
The Nigeria Data Protection Act 2023 (NDPA) is now the governing statute on how personal data including identifiable images and video can be collected, processed, stored, and shared.¹ Many content creators assume that being in a public place gives them unfettered freedom to film anyone and post it online. This assumption, however, overlooks fundamental legal principles.
Under the NDPA, images or videos of identifiable persons qualify as personal data.² Processing that data, whether through filming, editing, storing, publishing, or sharing typically requires a lawful basis. While consent is the default requirement, the Act outlines specific lawful grounds and statutory exemptions that allow certain filming activities without consent.
This article explains what personal data means under Nigerian law, why consent matters, and the specific situations where you can lawfully film people without consent. By the end, you’ll better understand how the NDPA balances privacy rights with public needs.
What Is Personal Data Under the NDPA and Why Consent Matters
At its core, the NDPA protects personal data, defined as information relating to an identified or identifiable natural person.¹ Under this definition, visual data such as photographs and videos that reveal a person’s identifiable features count as personal data if someone could reasonably be recognised from the content.
Because the law treats identifiable images as personal data, processing them normally requires consent. In the context of filming, this means:
You must inform people that their image will be recorded.
You must explain how the footage will be used, shared, or published.
Consent must be freely given, specific to that purpose, and unambiguous.
Consent is not a mere formality. It empowers individuals to control how their personal data, including their image and likeness is used.
However, consent is not the only lawful basis for processing identifiable footage. The NDPA lists other legal grounds under which processing may occur without consent, but only in clearly defined circumstances.
Lawful Bases for Processing Personal Data Under the NDPA
The NDPA recognises several lawful bases for processing personal data.³ These allow processing to proceed without consent when justified by specific legal reasons:
Legal obligation: Where processing is required to comply with a law or legal duty.
Contractual necessity: Where processing is necessary to perform a contract involving the data subject.
Vital interests: Where processing protects someone’s life or physical safety.
Public interest / official authority: Where processing is necessary for tasks carried out in the public interest or official functions.
Legitimate interests: Where processing is necessary and does not override the rights and freedoms of the data subject.
Each basis has a narrow scope and specific requirements. Understanding how and when they apply is essential for lawful filming or use of identifiable video content.
Statutory Exemptions: When You Can Film Without Consent
In addition to lawful bases, the NDPA and the General Application and Implementation Directive (GAID) 2025 provide statutory exemptions that allow filming identifiable people without consent in specific circumstances.⁴ These exemptions are designed to prevent the NDPA from interfering with essential societal functions like law enforcement, public safety, journalism, and legal processes.
1. Filming for Crime Prevention, Investigation, or Prosecution
One of the most important exemptions allows competent authorities to process personal data including identifiable video footage without consent when necessary to prevent, detect, investigate, prosecute, or adjudicate criminal offences.⁴
Example:
Police may use CCTV footage from a crowded bus station to identify suspects in a robbery without first obtaining consent from every individual captured in the footage. In this case, obtaining consent would be impractical and would hinder the law enforcement function.
This exemption recognises that criminal justice and public safety require tools that cannot always wait for individual permissions. However, even here, processing should remain necessary, proportionate, and limited to the specific law enforcement purpose.
2. Filming for National Security or Public Safety
The NDPA also permits processing without consent when necessary for national security, public safety, or to prevent or control a public health emergency.⁴
Example:
In an outbreak of a contagious disease, health authorities may film scenes at treatment centres or quarantine facilities to monitor compliance with public health measures or to document conditions for emergency responses.
Similarly, national security agencies may lawfully collect footage in ways that serve the broader security interests of the state.
These exemptions balance the public’s right to privacy with the urgent need to protect safety and security in crisis conditions.
3. Filming for Public Interest Reporting or Journalism
The NDPA recognises that some activities carried out in the genuine public interest such as reporting on major public events, news coverage, or educational documentaries should not be unduly restricted by consent requirements.⁴
Example:
A television journalist covering a protest march or civic procession may film participants and bystanders as part of a news report without seeking individual consent.
This exemption is important for media and journalism, where seeking consent from every person in a public crowd may be impossible and could interfere with timely reporting. It does not, however, extend to filming for casual entertainment or commercial exploitation under the guise of “news.”
The key criterion is whether the purpose of the filming serves a bona fide public interest.
4. Filming for Legal Proceedings or Administrative Processes
Another statutory exemption covers processing necessary to establish, exercise, or defend legal claims in court or administrative proceedings.⁴
Example:
Footage from a workplace accident may be collected and used in a legal claim for damages, even though the individuals involved did not consent to filming. In such cases, the recording is directly related to a legal process and can be used to support rights or obligations.
This exemption ensures that consent requirements do not obstruct access to justice or the proper documentation of evidence in legal disputes.
5. Legitimate Interest as a Lawful Basis
Beyond specific exemptions, the NDPA recognises legitimate interest as a lawful basis for processing personal data if:
the processing is necessary for the controller’s purpose;
it does not override the fundamental rights and freedoms of the data subject;
a reasonable person would expect the processing in the given context.³
Example:
Internal security monitoring in a workplace such as cameras installed to prevent theft, may rely on legitimate interest if employees are informed and the use is proportionate and limited.
However, for most content creators, filming for entertainment, social media virality, or commercial gain will not qualify as legitimate interest, because individuals would not reasonably expect their images to be used in those ways.
The GAID 2025 provides guidance on how to conduct a proper Legitimate Interest Assessment (LIA) to document necessity, proportionality, and safeguards.⁴
6. Vital Interests
Processing personal data without consent is also lawful where it is necessary to protect the vital interests of the data subject or another natural person.³
Example:
Filming a person who is unconscious after an accident to capture crucial evidence for medical intervention or identification may be lawful because it protects life and physical safety, situations where obtaining consent is impossible.
This basis is narrow and applies only in emergency scenarios where immediate action is required to protect life.
When Consent Is Still Required
Despite these exemptions and lawful bases, consent remains the default rule under the NDPA. Filming identifiable individuals for entertainment, viral social media content, promotional videos, or commercial exploitation still requires consent, unless one of the statutory exemptions or lawful bases clearly applies.
If consent is not obtained in situations where it is required, content creators and organisations may face enforcement action by the Nigeria Data Protection Commission (NDPC), including fines, compliance directives, and other penalties.
Even when lawful bases or exemptions apply, data controllers and processors are expected to adhere to core data protection principles such as data minimisation, purpose limitation, security safeguards, and accountability. These principles ensure personal data is processed responsibly and only to the extent necessary.
Practical Tips for Filming Responsibly in Nigeria
For creators, journalists, and organisations, the following best practices can help ensure compliance with the NDPA:
Always seek consent when filming identifiable individuals for entertainment or commercial content.
Document your lawful basis when relying on an exemption or legitimate interest.
Inform people clearly when filming is taking place and how the footage will be used.
Limit footage to what is necessary for your stated purpose.
Blur or anonymise faces when consent is not available, and no exemption applies.
Conduct a Legitimate Interest Assessment (LIA) when relying on that lawful basis, using GAID guidance.
These steps help balance creativity and compliance while respecting individuals’ privacy rights.
Conclusion
The Nigeria Data Protection Act 2023 represents a significant step toward balancing privacy rights with the realities of modern data use, including video recording and content creation. While consent remains the primary lawful basis for processing identifiable personal data, the law recognises specific exemptions where filming without consent is permitted — including law enforcement, national security, public interest reporting, legal proceedings, legitimate interest, and vital interests.
Content creators, journalists, and organisations should carefully assess their filming activities against these legal grounds. When in doubt, obtaining consent or seeking legal advice is the safest approach, particularly for content involving identifiable individuals used for entertainment or commercial purposes.
References
Nigeria Data Protection Act 2023, s 1 (personal data definition) (NDPA) (Nigeria).
Ibid.
Nigeria Data Protection Act 2023, s 25 (lawful bases for processing including contract, legal obligation, vital interests, public interest, legitimate interest) (NDPA) (Nigeria).
Nigeria Data Protection Act 2023, s 3 (exemptions including law enforcement, public safety, public interest reporting, legal claims) (NDPA) (Nigeria); Nigeria Data Protection Commission, General Application and Implementation Directive (GAID) 2025, NDPC/NDP ACT-GAID/01/2025.
