AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
Under the Nigeria Data Protection Act 2023, consent can be written, oral or electronic, silence is never consent, and the business must be able to prove it was given. A good form asks separately for marketing consent, tells the customer they can withdraw or object at any time, and is kept on file for as long as you hold the data.
What the NDPA says about consent
The Nigeria Data Protection Act 2023 (NDPA) applies to any business that collects personal data such as names, phone numbers, addresses, BVN, NIN or copies of ID cards. Consent is one of the lawful reasons for handling that data, and it is the one most small businesses rely on for marketing. According to a summary of section 26 of the Act published by Mondaq in September 2023, four rules matter most:
- You carry the burden of proof. If a customer later says they never agreed, the business has to show that they did.
- Silence or inactivity is not consent. A pre-ticked box, or 'we will assume you agree unless you tell us', does not count.
- Consent can be written, oral or electronic. A paper form, a ticked box on a website or a recorded WhatsApp reply can all work, as long as you can produce it.
- Consent can be withdrawn at any time. Withdrawal does not make earlier lawful processing unlawful, but you must stop from that point.
Where the person is a child or lacks legal capacity, the same summary notes that consent must come from a parent or guardian, and the business should have some way of checking age. Schools, clinics and children's salons should build that into the form.
Marketing needs its own tick box
The NDPA gives people a right to object to direct marketing (section 36), and the business must tell them about that right when it collects their data. A Templars note from February 2025 discusses Olatokun v Polaris Bank, a Lagos High Court decision of 5 December 2024 in which continued marketing emails after the customer asked them to stop were held to infringe his privacy. The note's point for small businesses: an unsubscribe link is not a full defence if you keep messaging someone who has objected.
In practice, that means separating the data you need to serve the customer (to deliver an order, issue a receipt, verify identity) from the data you want to market to them. Make marketing optional and unticked. For more on WhatsApp broadcasts specifically, see Can you send WhatsApp promos to customers? NDPA rules.
The template
Copy the text below onto your letterhead, a tablet form or a web page. Replace everything in square brackets. Keep the language plain; customers should understand it without help.
- Your details. Full name: ____ Phone: ____ Email (optional): ____ Address (only if we deliver to you): ____
- ID (only where we must verify you). ID type: ____ ID number: ____ We will see the original and [keep a copy / not keep a copy]. Reason: [e.g. rental of equipment, account opening, age-restricted product].
- Why we collect this. To [deliver your order, issue receipts and invoices, contact you about your booking, meet our legal record-keeping duties]. We will not use it for anything else without asking you.
- Who sees it. Our staff who need it, and [delivery partner / payment provider / accountant] only for the purposes above. We do not sell your data.
- How long we keep it. For as long as you are a customer and then for [period] to meet tax and accounting rules, after which we delete or destroy it.
- Marketing (optional). [ ] Yes, send me offers and news by: [ ] SMS [ ] WhatsApp [ ] Email. Leave blank if you do not want marketing. You can say STOP or contact us at any time and we will stop.
- Your rights. You can ask to see the data we hold, correct it, have it deleted where the law allows, object to marketing, withdraw this consent, or complain to the Nigeria Data Protection Commission.
- Signature. Name: ____ Signature or electronic confirmation: ____ Date: ____ Staff name: ____
- For a child under 18. Parent or guardian name: ____ Relationship: ____ Signature: ____
Keeping proof that will stand up
Because the burden of proof sits with you, the record matters as much as the form. A simple consent log does the job:
| Field | What to record |
|---|---|
| Customer | Name and phone number |
| Date and channel | In store, website, WhatsApp, phone call |
| What they agreed to | Service data only, or marketing too, and which channels |
| Evidence | Signed form reference, screenshot, form submission ID |
| Withdrawal or objection | Date received and date you stopped |
Review the log before every campaign and remove anyone who has objected. Staff who run broadcasts should check it, not their memory.
What happens if you get it wrong
The Nigeria Data Protection Commission's FAQ page describes its powers under section 48 of the NDPA: it can order a business to remedy a breach, pay compensation, account for profits and pay a remedial fee. For most businesses the fee can reach the greater of ₦2,000,000 or 2% of annual gross revenue; for those classed as data controllers of major importance, the greater of ₦10,000,000 or 2%. Customers can also go to court, as the Polaris case shows. This is information, not legal advice; a business handling health, biometric or children's data should take advice on its specific setup.
What to check first
- List every place you collect customer data: till, website, WhatsApp, delivery forms.
- Remove any pre-ticked marketing boxes.
- Add the objection and withdrawal sentence to each form.
- Start a consent log and decide who owns it.
- Decide a deletion date for old records and stick to it.
Where Pryme fits
A Pryme Business Account comes with a Compliance agent, built by Pryme Intelligence, that can prepare checklists and keep a recorded trail of who approved what, with a person signing off above a set ceiling. Our guide to consent records and the Compliance agent covers this in more detail, and the customer side is explained in Your data rights under the NDPA.
Questions people ask
Is a WhatsApp 'yes' valid consent under the NDPA?
Consent can be electronic, so a clear WhatsApp reply agreeing to a specific use can count. You must be able to produce it later, so screenshot or export it and log it.
Do I need consent to keep a customer's phone number for delivery?
Consent is only one lawful basis. Data needed to fulfil an order is usually handled on another basis, but marketing to that number later needs its own clear agreement.
What happens if a customer says stop?
Stop marketing from that point and record the date. The NDPA gives a right to object to direct marketing, and a Lagos High Court case in 2024 found continued messages after a stop request infringed privacy.
Can I photocopy a customer's ID card?
Only if you need it for a stated purpose, you tell the customer why, and you keep it securely and delete it when no longer needed. If you only need to see it, do not keep a copy.
Sources
- Mondaq: The Nigeria Data Protection Act 2023, a look at key provisions (18 Sep 2023) · accessed Oct 2026
- Templars: Unsolicited messaging and the limits of opt-out provisions (10 Feb 2025) · accessed Oct 2026
- Nigeria Data Protection Commission: FAQs · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.