AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
It depends on who employs the person in Nigeria. Under the EDPB's final Guidelines 05/2021 (14 February 2023), a transfer happens when a GDPR-bound exporter makes data available, including by remote access, to another controller or processor in a third country; your own employees working inside your organisation are not a separate recipient, but an outsourcer, employer of record or contractor in Nigeria usually is, and then you need a GDPR transfer tool. Nigeria's Data Protection Act 2023 also applies to processing carried out in Nigeria.
Two scenarios that look the same and are not
An Irish company sets up a customer support team in Lagos. The agents open the same CRM, read the same tickets and see the same names, emails and order histories. Whether that is a GDPR "transfer" depends less on what they can see than on who they are, legally.
What counts as a transfer
The European Data Protection Board's Guidelines 05/2021, adopted in final form on 14 February 2023 and summarised by DLA Piper, set three cumulative criteria:
- the exporter (controller or processor) is subject to the GDPR for the processing;
- the exporter discloses the data, or otherwise makes it available, to another controller, joint controller or processor (the importer);
- the importer is in a third country, whether or not it is itself subject to the GDPR.
Remote access from a third country can be "making available". But purely internal processing, where data stays inside the controller's own organisation and is not passed to another controller or processor, is not a transfer. The guidelines' example is an employee travelling abroad: Chapter V may not apply, but the controller stays fully accountable and must assess risks such as local laws and apply suitable security.
| Who the Nigerian worker is | Separate recipient? | Likely result |
|---|---|---|
| Your own employee, on your payroll, working remotely | No, part of your organisation | Not a Chapter V transfer; GDPR security and accountability still apply |
| Employee of a Nigerian subsidiary | Yes, a separate company | Transfer; transfer tool needed |
| Staff of an employer of record that employs them for you | Usually yes, the EOR or its local entity | Treat as a transfer and paper it |
| Freelance contractor with their own business | Yes, typically a processor | Transfer; processor contract and transfer tool |
| Staff of a Nigerian outsourcing (BPO) firm | Yes, a processor | Transfer; processor contract and transfer tool |
Whether a given employer-of-record set-up makes the workers part of your organisation or the EOR's is a fact question; ask your data protection adviser to look at the actual contracts.
Safeguards when it is a transfer
If the route is a transfer, the GDPR requires a lawful transfer basis. Check the European Commission's list of adequacy decisions for Nigeria; without one, businesses usually rely on the Commission's standard contractual clauses, signed with the Nigerian recipient, plus an assessment of Nigerian law and practice. The EDPB and German authorities, as DLA Piper reports, point to technical and organisational measures, a detailed review of the third country's law, assurances from the partner and whether they can be honoured, and other risks of the transmission.
In practice, for a Lagos support team that means:
- a written processor agreement covering instructions, confidentiality, security, sub-processors and deletion;
- the transfer clauses and a short written assessment of the Nigerian legal environment;
- access controls: named log-ins, role-based access, no local downloads, multi-factor authentication;
- company-managed devices or virtual desktops, so data does not sit on personal laptops;
- a log of who accessed what, kept for audits and subject access requests;
- training in Irish and EU data rules, including how to spot and escalate a breach;
- a clear route for customers' access, correction and erasure requests that reach the Lagos team, so they are passed to the Dublin owner the same day.
Nigeria's own law also applies
The Nigeria Data Protection Act 2023 applies, under section 2(2), where a controller or processor is domiciled, resident or operating in Nigeria, where processing occurs in Nigeria, or where a controller abroad processes data of data subjects in Nigeria. A Lagos processor handling your Irish data is processing in Nigeria, so it has NDPA duties too; section 29 sets processor duties and requires a written agreement. Section 41 restricts transfers out of Nigeria, which matters for data collected there, such as your Nigerian staff's HR records sent to Dublin. Our Nigeria library covers data rights under the NDPA.
What to check first
- Map who in Nigeria has access, through which employer, to which systems.
- Classify each route: internal, or a transfer to another controller or processor.
- For each transfer, sign the processor terms and the transfer clauses and record your assessment.
- Limit access to what each role needs; turn off exports and downloads.
- Update your privacy notice to mention international transfers.
- Check the NDPA duties of your Nigerian partner and for your Nigerian staff data.
Setting up the team itself is covered in setting up a Nigerian support team, and the tax side in permanent establishment risk.
Where Pryme fits
Pryme's Customer Support agent and Compliance agent prepare work and log actions, with a person approving above a set ceiling. They do not replace your transfer paperwork, but the record of who did what helps when you need to show accountability.
Questions people ask
Is remote access from Nigeria a data transfer under GDPR?
It can be. Under the EDPB guidelines, remote access by another controller or processor in a third country is a transfer; access by your own employees inside your organisation is not.
Do I need standard contractual clauses for a Nigerian outsourcer?
If the outsourcer is a processor in Nigeria and there is no adequacy decision, businesses usually rely on the Commission's standard contractual clauses plus an assessment.
Does the Nigeria Data Protection Act apply to my Irish company?
It applies to processing carried out in Nigeria and to controllers abroad processing data of people in Nigeria, under section 2(2).
Can my Lagos agents use their own laptops?
Nothing bans it outright, but GDPR security duties make company-managed devices or virtual desktops the safer choice.
Sources
- DLA Piper Privacy Matters: final EDPB Guidelines 05/2021 on Article 3 and Chapter V GDPR (Mar 2023) · accessed Oct 2026
- Nigeria Data Protection Act 2023 (KPMG copy) · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.