AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
Background checks on candidates in Nigeria are lawful when they follow the Nigeria Data Protection Act 2023: a lawful basis for each check, a clear notice to the candidate before you collect anything, only the data the role needs, and deletion when it is no longer necessary. Health, biometric, religious and similar data are sensitive personal data under the Act and need a section 30 ground such as explicit consent. If your UK company is the controller, UK data protection law can apply as well.
A UK owner hiring a finance assistant or developer in Lagos usually wants the same assurance a UK employer gets: that the person is who they say they are, holds the qualifications on the CV and has the work history claimed. The checks are possible, but the rules that govern them are Nigerian as well as British, and the way you collect information matters as much as what you collect.
Why the NDPA applies to a UK employer
Section 2(2) of the Nigeria Data Protection Act 2023 extends the Act to a controller or processor not in Nigeria that processes the personal data of a data subject in Nigeria. A candidate living in Lagos is a data subject in Nigeria, so a UK company vetting them is within scope even if it has no Nigerian office. For the wider picture, see staff data under the NDPA for UK employers.
The rules each check has to meet
- Lawful basis (s.25)
- Consent, contract, legal obligation, vital interests, public task or legitimate interests. For pre-employment checks, steps taken at the candidate's request before a contract, or legitimate interests, are usually more natural than consent; pick and record one per check.
- Principles (s.24)
- Fair, lawful and transparent processing; a specified purpose; only data that is adequate and limited to what is needed; kept no longer than necessary; kept secure.
- Notice (s.27)
- Before collecting, tell the candidate who you are, the purpose and lawful basis, who will receive the data, how long you keep it, their rights and their right to complain to the NDPC.
- Consent rules (s.26)
- If you rely on consent you must be able to prove it, silence is not consent, and it can be withdrawn at any time.
- Sensitive data (s.30)
- Genetic and biometric data, race or ethnic origin, religious beliefs, health, sex life, political opinions and trade union membership need a section 30 ground, such as explicit consent or an employment-law obligation.
- Automated decisions (s.37)
- A candidate has the right not to be subject to a decision based solely on automated processing with significant effects, subject to exceptions and safeguards.
Checks that usually fit, and how to run them
| Check | How to keep it within the rules |
|---|---|
| Identity | See the passport or national ID once; record that it was verified rather than keeping copies you do not need. |
| Qualifications | Ask the candidate to authorise you to contact the institution, or to supply verified copies; check only the qualifications the role requires. |
| Employment references | Tell the candidate which employers you will contact and what you will ask. Keep questions to role-relevant facts. |
| Right to work in Nigeria | Relevant only for non-Nigerians, who need the correct permit; Nigerian citizens do not. |
| Credit or bureau checks | Hard to justify except for roles handling money; record why the role needs it. |
| Social media screening | High risk of collecting more than you need, including sensitive data such as religion or politics. If you do it, limit it to public professional profiles and say so in the notice. |
Criminal-record checks
The NDPA's definition of sensitive personal data, in section 65, lists genetic and biometric data, race, religion, health, sex life, political opinions and union membership. It does not list criminal records, although the NDPC can prescribe more categories under section 30(2). That does not make a criminal check casual: it is still personal data that must be necessary for the role, covered by a lawful basis and disclosed in the notice. For a role with access to payments, you can ask the candidate to obtain a police character certificate from the Nigeria Police Force themselves and share it, which keeps the candidate in control of what is sent. Check the force's current application process and fee with the force directly.
If your UK company is the controller, UK data protection law can also apply to the processing, and UK GDPR has its own stricter rules for criminal offence data. The ICO's employment guidance applies to anyone who performs work for an organisation; take advice on how both regimes apply to you.
Using a screening firm
A vetting firm in Lagos acts as your processor. Section 29 of the NDPA requires a written agreement and places duties on the processor, including security and help with data subject rights. If the firm sends reports to you in the UK, that is a transfer of data out of Nigeria, which sections 41 to 43 allow only on an adequacy basis, appropriate safeguards such as contractual clauses, or a listed derogation such as consent after being told the risks. Put the transfer basis in the contract.
Steps
- List the checks the role actually needs, and why.
- Choose and record a lawful basis for each one.
- Give the candidate a written notice covering every item in section 27 before you start.
- Run the checks, or have the candidate supply documents.
- Make the decision with a person involved, not solely by software.
- Delete what you no longer need, keeping only a record that the check was done.
- If you use a vetting firm, sign a processor agreement that covers transfers.
Where Pryme fits
Once a hire is confirmed, a Pryme Business Account can run payroll in naira, and the Compliance agent can keep a record of which pre-employment checks were completed for each person, with a person approving the final decision. See the Compliance agent.
Questions people ask
Can I do a background check on a Nigerian employee from the UK?
Yes, if you follow the NDPA 2023, which applies to controllers outside Nigeria processing data of people in Nigeria: a lawful basis, a section 27 notice, only necessary data and secure handling.
Do I need consent for a background check in Nigeria?
Not always. Section 25 offers other bases such as contract steps or legitimate interests. Sensitive data under section 30 usually needs explicit consent or another listed ground.
Is a criminal record sensitive data under the NDPA?
The section 65 definition does not list criminal records, but the NDPC can add categories. Treat the check as high-risk personal data and limit it to roles that need it.
Can a vetting company in Lagos send reports to my UK office?
Only with a transfer basis under sections 41 to 43, such as contractual clauses or consent after being told the risks, and a written processor agreement under section 29.
Sources
- Nigeria Data Protection Act 2023 (KPMG copy of the Act) · accessed Oct 2026
- NDPC: Frequently asked questions (sanctions under section 48) · accessed Oct 2026
- ICO: Data protection and monitoring workers (page dated 28 Sep 2026) · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.