AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
The Nigeria Data Protection Act 2023 applies to any company in Nigeria and to any company abroad that processes personal data of people in Nigeria, so where the owner lives makes no difference. Companies above the NDPC's volume thresholds must register as data controllers or processors of major importance, appoint a data protection officer and file a yearly compliance audit return by 31 March; every company must also manage breaches and cross-border transfers properly.
Does the Act apply to you?
Section 2(2) of the NDPA applies the Act where the controller or processor is domiciled, resident or operating in Nigeria, where processing happens in Nigeria, or where a controller or processor outside Nigeria processes data of people in Nigeria. A Nigerian company run from London is caught on the first limb; your foreign parent may be caught on the third.
Personal data here includes staff files, customer lists, WhatsApp numbers, CCTV and anything else that identifies a person. Section 3 exempts purely household processing, which a business is not.
The duties every company has
- Principles (s.24): process fairly, lawfully and transparently; collect only what you need; keep it no longer than necessary; keep it secure.
- A lawful basis (s.25): consent, contract, legal obligation, vital interests, public task or legitimate interests.
- Telling people (s.27): at collection, explain who you are, the basis and purpose, who receives the data, their rights, how long you keep it and their right to complain to the Commission.
- Rights (ss.34-38): access, correction, erasure, restriction, portability, objection, and not to be subject to purely automated decisions.
- Processors (s.29): written agreements with any outside provider that handles data for you, such as payroll or CRM tools.
- Security (s.39): measures such as encryption, pseudonymisation and testing.
Marketing is a common trip-wire. Our Nigeria guide on WhatsApp promotions under the NDPA covers consent and objection.
Registration, the DPO and audit returns
Section 44 requires data controllers and processors "of major importance" to register with the NDPC. The NDPC's General Application and Implementation Directive (GAID), issued in March 2025, sets three tiers. A January 2026 Mondaq note from Templars summarises them:
| Tier | Who falls in it (per Templars summary) | Registration |
|---|---|---|
| Ultra-high level (UHL) | Banks, telcos, insurers, fintechs, payment gateways, DisCos and others, plus any organisation processing data of more than 5,000 people in 6 months | Once |
| Extra-high level (EHL) | MDAs, microfinance banks, higher institutions, hospitals, mortgage banks, plus organisations processing more than 1,000 but fewer than 5,000 people in 6 months | Once |
| Ordinary-high level (OHL) | Smaller organisations of major importance | Yearly |
A May 2025 Mondaq note on the GAID says a data protection officer is required and that UHL and EHL organisations file a compliance audit return each year. Templars adds that the return is due on or before 31 March through a licensed Data Protection Compliance Organisation (DPCO) on the NDPC portal, with up to 50% extra on the filing fee for late filing. We could not read the fee table, so check current fees with a licensed DPCO.
For a company run from abroad, the DPO matters most: you need a named person who knows where the data is and can answer the NDPC and data subjects. The Act does not, in the sources we read, require that person to live in Nigeria, but they must be reachable during Nigerian working hours.
Breaches: the 72-hour clock
Section 40 requires a processor to tell the controller when it becomes aware of a breach, and the controller to notify the NDPC within 72 hours where the breach is likely to risk people's rights. Where the risk is high, the people affected must be told without delay. Every breach must be recorded. If the only person who can approve a report is asleep in Calgary, agree in advance who in Lagos can file it.
The cross-border point owners miss
When you open the company's customer database from your laptop abroad, or store staff files in a cloud account hosted outside Nigeria, personal data leaves Nigeria. Section 41 permits a transfer out of Nigeria only where the recipient is subject to adequate protection, such as through law, binding corporate rules, contractual clauses, codes of conduct or certification, or under the section 43 exceptions, which include informed consent and performance of a contract. Section 41(2) requires you to record the basis you rely on.
- List where company data is stored and who accesses it from abroad.
- Put a data transfer agreement in place between the Nigerian company and any foreign parent or provider.
- Record the basis for each transfer.
- Update your privacy notice to say data may be accessed abroad.
Penalties
The NDPC's FAQ explains that under section 48 it can order a remedy, compensation or an account of profits, and impose a remedial fee of up to the greater of ₦10,000,000 or 2% of annual gross revenue for organisations of major importance, or the greater of ₦2,000,000 or 2% for others.
Where Pryme fits
The Compliance agent on a Pryme Business Account can prepare the 31 March reminder and a breach log template for a person to approve. See how Pryme secures accounts and our guide to keeping records across Nigeria and abroad.
Questions people ask
Does the NDPA apply to a company owned from abroad?
Yes. Section 2(2) applies it to any controller or processor operating in Nigeria, and to those outside Nigeria processing data of people in Nigeria.
When is the NDPC compliance audit return due?
On or before 31 March each year, filed through a licensed DPCO, according to a January 2026 Templars summary of the GAID.
Does my small Nigerian business need to register with the NDPC?
Only if it is a data controller or processor of major importance under the GAID tiers. Templars' summary puts organisations processing data of more than 1,000 people in six months in the higher tiers; check the GAID for your sector.
Can I access my Nigerian customer data from abroad?
Yes, but it is a transfer out of Nigeria. Section 41 requires an adequacy basis such as contractual clauses, or a section 43 exception, and you must record the basis.
Sources
- Nigeria Data Protection Act 2023 (KPMG copy) · accessed Oct 2026
- NDPC: FAQs · accessed Oct 2026
- Mondaq (Templars): NDPA audit return obligations for 2026 (28 Jan 2026) · accessed Oct 2026
- Mondaq (Adeola Oyinlade & Co): key updates under the 2025 GAID (21 May 2025) · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.