AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
The Nigeria Data Protection Act 2023 has no section written specifically for workplace monitoring, so monitoring Nigerian staff is judged against its general rules: a lawful basis, a clear notice to staff, only what is necessary for a stated purpose, security, and a data privacy impact assessment where the monitoring is likely to be high risk. If your UK company is the controller, the ICO's monitoring guidance is a useful benchmark and may apply too; it treats keystroke and biometric monitoring as high risk and webcam presence checks as disproportionate.
Remote teams raise a natural question for a UK owner: how do I know the work is being done, and that customer data is safe, when staff are in Lagos and I am in Leeds? Monitoring software makes almost anything possible, from login records to screenshots and webcam snapshots. The law draws the line well short of "anything possible", and the line is set mainly by data protection rules in Nigeria and, often, in the UK.
Which law applies
Section 2(2) of the Nigeria Data Protection Act 2023 applies the Act where processing happens in Nigeria, and to controllers outside Nigeria processing the data of data subjects in Nigeria. Staff working in Lagos are both. The Act contains no provision dedicated to employee monitoring; its general principles do the work. If your UK company decides what is monitored and why, it is the controller, and UK data protection law can apply to its processing as well. The ICO's guidance on monitoring workers says it applies to all relationships where a person performs work for an organisation. More background: staff data under the NDPA for UK employers.
The NDPA tests every monitoring tool must pass
- Purpose and minimisation (s.24)
- Collect data for a specified, legitimate purpose, limited to what is necessary, kept no longer than needed and kept secure.
- Lawful basis (s.25)
- Consent, contract, legal obligation, vital interests, public task or legitimate interests. Monitoring usually rests on legitimate interests, which requires weighing your interest against the staff member's rights.
- Notice (s.27)
- Tell staff before you collect: who you are, what is monitored and why, the lawful basis, who receives the data, how long it is kept and their rights, including the right to complain to the NDPC.
- Impact assessment (s.28)
- Where processing is likely to result in high risk to people's rights and freedoms, carry out a data privacy impact assessment before starting, and consult the NDPC if high risk remains.
- Sensitive data (s.30)
- Biometric data used to identify someone, health data and similar categories need a section 30 ground such as explicit consent.
- Automated decisions (s.37)
- Staff have the right not to be subject to decisions based solely on automated processing with significant effects, such as an algorithm that flags and dismisses.
- Rights (s.34)
- Staff can ask for access to, and correction or erasure of, their data.
Common tools, ranked by risk
The ICO's guidance gives a practical scale that works well alongside the NDPA tests.
| Tool | Risk | What the ICO guidance says or implies |
|---|---|---|
| Login and system access logs | Lower | Cited by the ICO as a less intrusive way to check remote workers are present |
| Monitoring work email and company systems for security | Moderate | Needs a clear purpose, notice and limits on who reads what |
| Random screenshots | Higher | Counts as systematic monitoring even though it is not continuous |
| Keystroke logging | High | Listed as high risk; a DPIA is required |
| Biometric sign-in or tracking | High | Biometric data used for identification is special category data; a DPIA is required |
| Webcam presence checks | Very high | The ICO describes using webcams to check presence as disproportionate where login times would do |
| Covert monitoring | Exceptional | Only for suspected criminal activity or gross misconduct, authorised by senior management, time-limited |
Home is not an office
The ICO notes that workers' expectations of privacy are likely to be significantly greater at home, and that monitoring at home risks capturing family members and private life. In a Lagos flat shared with relatives, a camera or microphone captures people who never agreed to anything. Consider them in the impact assessment, and prefer tools that measure work output over tools that observe the room.
Consent is the wrong foundation
Asking staff to tick a box agreeing to monitoring feels safe but is weak. The ICO says consent is not usually appropriate in employment because of the imbalance of power, and the NDPA requires that consent be provable and withdrawable at any time (section 26). If a staff member withdraws consent, monitoring built on it must stop. Pick a basis that does not depend on agreement, and use the notice to explain it.
Steps before switching anything on
- Write down the problem the monitoring solves (security, a regulatory requirement, workload planning).
- Choose the least intrusive tool that solves it.
- Record the lawful basis and, for legitimate interests, the balancing test.
- Run a data privacy impact assessment for anything high risk.
- Give staff a written notice covering every section 27 item, before you start.
- Limit who can see the data, and set a short retention period.
- Keep a person in any decision that affects someone's job.
- Review the arrangement at least yearly and when tools change.
Staff also have their own rights to see what is held about them; the Nigeria library explains data rights under the NDPA.
Where Pryme fits
Much monitoring exists to protect money. A Pryme Business Account limits that risk at the source: actions above a set ceiling need a person's approval and every action is recorded, which gives a clear trail of who did what without watching anyone's screen. See security and the Compliance agent.
Questions people ask
Can I monitor my remote employees in Nigeria?
Yes, within the NDPA: a lawful basis, a section 27 notice, only what is necessary, secure handling, and an impact assessment where the monitoring is high risk.
Is keystroke monitoring legal in Nigeria?
The NDPA does not ban a specific tool, but keystroke logging is high-risk processing that should go through a section 28 impact assessment. The ICO lists it as high risk.
Do I need staff consent to monitor them?
Usually not, and it is a weak basis in employment. Legitimate interests with a balancing test and a clear notice is more common.
Can I use webcams to check staff are working from home?
The ICO describes webcam presence checks as disproportionate where less intrusive methods, such as login times, exist. Home monitoring also captures family members.
Sources
- Nigeria Data Protection Act 2023 (KPMG copy of the Act) · accessed Oct 2026
- ICO: Data protection and monitoring workers (page dated 28 Sep 2026) · accessed Oct 2026
- NDPC: Frequently asked questions (sanctions under section 48) · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.