AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
The Nigeria Data Protection Act 2023 applies to a US company that processes personal data of people in Nigeria, even with no Nigerian office (s.2(2)(c)). The core duties are a lawful basis for each use, appropriate security, notifying the NDPC within 72 hours of a risky breach, and lawful transfers out of Nigeria. Larger processors must register as data controllers of major importance and file annual compliance audit returns by 31 March. Fines can reach the greater of ₦10 million or 2% of annual gross revenue.
When the Act applies to a US company
Section 2(2) of the Act covers a controller or processor that is domiciled, resident or operating in Nigeria, processing that takes place in Nigeria, and a controller or processor outside Nigeria that processes the personal data of a data subject in Nigeria. A US company with Nigerian employees, Nigerian contractors on its systems, or customers in Nigeria is caught by the last limb. A Nigerian subsidiary is caught by the first.
The core duties
| Duty | Section | What it means in practice |
|---|---|---|
| Principles and accountability | s.24 | Collect only what you need, keep it accurate, keep it only as long as needed |
| Lawful basis | s.25 | Consent, contract, legal obligation, vital interests, public task or legitimate interests |
| Consent done properly | s.26 | The controller must prove consent; silence is not consent; it can be withdrawn |
| Processors under contract | s.29 | Written agreement with any vendor processing data for you |
| Security | s.39 | Measures such as encryption, pseudonymisation and testing |
| Breach notification | s.40 | Tell the NDPC within 72 hours of becoming aware if rights are at risk; tell individuals if the risk is high |
| Transfers out of Nigeria | ss.41 to 43 | Need an adequacy basis or a listed exception, with a record of the basis |
Section references follow the Act's text. The point on consent comes from an LL Lexworth summary published on Mondaq in September 2023.
Staff data
Employee files hold some of the most sensitive data a company keeps. The Act defines sensitive personal data in s.65 to include health, religious beliefs, ethnic origin, trade union membership and biometric data used for identification, among others. Section 30 limits the grounds for processing it; one is meeting obligations in employment or social security law. So a pension or health insurance enrolment can rely on that ground, but collecting religion "for the file" cannot.
Section 28 requires a data protection impact assessment before processing likely to be high risk, which can include monitoring staff devices or using AI tools on HR data. If an agent or algorithm makes decisions about staff, s.37 gives them the right not to be subject to a decision based solely on automated processing, subject to exceptions; see AI agents for back-office work.
Moving data to the US
Sending Nigerian staff or customer data to servers or teams in the US is a transfer. Section 41 allows it where the receiving country or arrangement gives adequate protection, which can be shown through law, binding corporate rules, contractual clauses, a code of conduct or certification. Without that, s.43 allows transfers on limited grounds, such as informed consent after being told the risks, performance of a contract with the person, or legal claims. Section 42(6) says that the absence of a Commission decision on a country does not make it adequate. Record the basis for each transfer, as s.41(2) requires.
Registration and annual audit returns
The NDPC's General Application and Implementation Directive (GAID), issued on 20 March 2025 and operational from 19 September 2025 according to an Adeola Oyinlade & Co summary on Mondaq, sorts data controllers and processors of major importance into tiers and requires a data protection officer. According to Templars, writing in January 2026, the higher tiers include organisations processing data of more than 1,000 data subjects in six months, and compliance audit returns are due on or before 31 March each year through a licensed data protection compliance organisation; late filing can add up to 50% of the filing fee. Whether your company must register depends on volume and sector; see NDPA registration for a US company and our sister site's DCPMI registration guide.
Penalties
The NDPC's FAQs say the Commission can order a controller to remedy a breach, pay compensation, account for profits and pay a remedial fee: up to the greater of ₦10 million and 2% of annual gross revenue for data controllers of major importance, and up to the greater of ₦2 million and 2% for others. Data subjects can also go to court.
Keep the evidence that you met each duty: the records of processing, the transfer basis, the processor contracts and the breach log that s.40(8) requires. Those are what the Commission will ask for first.
Steps for a US company
- Map what Nigerian personal data you hold, where it sits and who can see it.
- Write down the lawful basis for each use, and for each transfer to the US.
- Put processor agreements in place with payroll, HR and support vendors.
- Check whether you meet a GAID registration threshold and, if so, diarise 31 March.
- Set a breach plan that can reach the NDPC within 72 hours.
Where Pryme fits
Pryme Business Accounts use an authenticator app rather than SMS codes and a transaction PIN, and the agents' actions are recorded, which helps when you need to show who accessed what. See security and Compliance.
Questions people ask
Does the Nigeria Data Protection Act apply to foreign companies?
Yes. Section 2(2)(c) applies it to controllers and processors outside Nigeria that process personal data of people in Nigeria.
How fast must a data breach be reported in Nigeria?
Within 72 hours of the controller becoming aware of it, where it is likely to put people's rights at risk (s.40).
Can I transfer Nigerian employee data to the US?
Yes, on a basis in ss.41 to 43, such as adequate safeguards through contractual clauses or binding corporate rules, or a listed exception. Record the basis.
What is the fine under the NDPA?
Up to the greater of ₦10 million or 2% of annual gross revenue for data controllers of major importance, and ₦2 million or 2% for others, per the NDPC.
Sources
- Nigeria Data Protection Act 2023, full text (KPMG copy) · accessed Oct 2026
- Nigeria Data Protection Commission: FAQs · accessed Oct 2026
- Mondaq (Adeola Oyinlade & Co): Key regulatory updates under the 2025 GAID (21 May 2025) · accessed Oct 2026
- Mondaq (Templars): Data protection compliance in Nigeria, audit return obligations for 2026 (28 Jan 2026) · accessed Oct 2026
- Mondaq (LL Lexworth): The Nigeria Data Protection Act 2023, key provisions (18 Sep 2023) · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.