AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
Part of the guideIs your money safe in a Nigerian fintech?
The short answer
The Nigeria Data Protection Act 2023 gives you the right to be told how your data is used, to access and correct it, to have it erased or its use restricted where there is no longer a lawful basis, to object, to withdraw consent, to move it to another provider and not to be subject to purely automated decisions. Ask the bank or fintech first, in writing; if it does not respond properly, complain to the Nigeria Data Protection Commission (NDPC).
Financial apps hold some of the most sensitive data about you: your BVN and NIN, ID documents, selfies, transaction history and often your location. The Nigeria Data Protection Act (NDPA), signed on 12 June 2023, sets the rules on how they may use it and gives you enforceable rights. This article explains those rights and how to use them. For how data protection fits with licences and deposit insurance, see our guide is your money safe in a Nigerian fintech?
Your rights, in plain terms
| Right | What you can ask for | Typical use with a bank or fintech |
|---|---|---|
| To be informed | A clear explanation of what data is collected, why, who it is shared with and how long it is kept | Reading or requesting the privacy notice |
| Access | A copy of the personal data held about you | Seeing what an app has stored after onboarding |
| Rectification | Correction of inaccurate or incomplete data | Fixing a misspelt name or wrong address |
| Erasure | Deletion where there is no longer a lawful basis to keep it | Removing data from an app you never fully signed up to |
| Restriction | Limiting use while a dispute is resolved | Pausing use of data you say is wrong |
| Objection | Stopping certain uses, such as direct marketing | Ending promotional messages |
| Withdraw consent | Withdrawing consent you gave earlier | Revoking an app's access to contacts or location |
| Portability | Your data in a usable form, or sent to another provider | Moving to a new provider |
| Automated decisions | Not to be subject to a decision based solely on automated processing that significantly affects you | Asking for human review of an automated credit refusal |
What organisations must do
Under the Act, an organisation needs a lawful basis to process your data. Section 25 lists six: consent, performance of a contract, compliance with a legal obligation, protecting vital interests, public interest, and legitimate interest. For a bank, most onboarding data falls under contract and legal obligation, which is why you cannot open an account without giving your BVN or NIN. Marketing and optional features usually rely on consent, which you can withdraw.
- Collect only what they need and keep it no longer than necessary.
- Keep it secure, and report a breach to the NDPC within 72 hours of becoming aware of it where it is likely to pose a high risk; tell affected people immediately where the risk to them is high.
- Appoint a Data Protection Officer if they are a data controller or processor of major importance, which includes most banks and large fintechs.
- Provide systems that let you access, correct and update your data, and a clear way to raise complaints.
The NDPC's General Application and Implementation Directive (GAID), issued on 20 March 2025, adds detail. It introduced a Standard Notice to Address Grievance (SNAG), a formal way for you to seek redress directly from an organisation before going to the regulator.
How to make a request: a worked example
Nkechi tried a lending app in 2025, did not take a loan, and has received marketing messages since. She wants her data deleted and to know whether it was shared.
- She writes to the app's privacy or support email, found in its privacy notice, stating her name, phone number and the account email.
- She makes specific requests: a copy of all personal data held about her; the names of any third parties it was shared with; deletion of data not required by law; and an end to marketing.
- She asks the app to confirm which data it must keep by law and for how long.
- She keeps a dated copy of the request and any reply.
- If there is no proper response, she escalates to the NDPC with her evidence.
Separately, she checks the FCCPC's approved lenders list, because a lending app that harvests contacts or harasses people also breaches the FCCPC's digital lending rules, with fines of up to ₦100 million or 1% of turnover. Our guide on how to complain about a bank or fintech covers that route.
Enforcement: what the NDPC can do
The NDPC can investigate, order an organisation to comply and impose penalties. For a data controller or processor of major importance, the maximum is the higher of ₦10 million or 2% of annual gross revenue. For a company with ₦50 billion in annual revenue, 2% would be ₦1 billion.
Enforcement is active. In August 2024 the NDPC fined Fidelity Bank ₦555.8 million, about 0.1% of its 2023 revenue, saying the bank processed personal data without informed consent in some cases and used non-compliant third-party processors; the bank disputed the findings. In 2025 the NDPC opened compliance investigations into 1,368 organisations, 795 of them financial institutions.
Where your payment data lives
A CBN circular of 15 June 2026 requires banks, payment service providers, mobile money operators and other payment participants to store and manage payment transaction data generated in Nigeria within Nigeria, including backups, by 1 January 2027. This sits alongside the NDPA's rules on cross-border transfers rather than replacing them.
Protecting your data day to day
- Share your BVN and NIN only inside official apps, at your own initiative. Our article on whether it is safe to share your BVN covers the scams.
- Where an organisation accepts a virtual NIN, use it instead of your NIN. Our explainer on BVN vs NIN shows how.
- Refuse app permissions that have nothing to do with the service, especially contacts, photos and call logs.
- Read the privacy notice for who data is shared with, and opt out of marketing you do not want.
Where Pryme fits
Pryme collects the data CBN rules require to open and run your account, including a BVN and/or NIN. Sign-in uses a password and an authenticator app rather than SMS codes, and a transaction PIN is asked at the last step; see the security page. If you take Spaces credit, the lender, Solid Allianze Microfinance Bank Ltd, draws on Nigeria's licensed credit bureaus, and as a CBN-licensed lender its credit activity sits within Nigeria's credit-reporting system. To exercise your rights under the NDPA, such as access, correction or deletion, contact Pryme through contact; if you are not satisfied with the response, the complaint route to the NDPC described above applies, as it does to any organisation.
For the wider set of checks on any provider, read our guide to fintech safety in Nigeria.
Questions people ask
What are my rights under the Nigeria Data Protection Act?
You can be informed, access and correct your data, ask for erasure or restriction, object, withdraw consent, move your data and challenge purely automated decisions. Some rights are limited where the law requires a bank to keep records.
Can I ask a bank to delete my data in Nigeria?
You can ask, and the bank must delete data it no longer has a lawful basis to keep. It must keep records that laws such as anti-money-laundering rules require, and should tell you which.
How do I report a data breach or misuse to the NDPC?
Raise it with the organisation first and keep a copy. If it is not resolved, complain to the NDPC with your evidence and the organisation's response.
Can a loan app access my contacts?
It should not need them to assess a loan. Under the FCCPC's digital lending rules, misusing borrowers' data or harassing their contacts can lead to fines of up to ₦100 million or 1% of turnover.
What fine can the NDPC impose?
Up to the higher of ₦10 million or 2% of annual gross revenue for a data controller or processor of major importance. In 2024 it fined Fidelity Bank ₦555.8 million.
Sources
- Mondaq: an overview of the Nigeria Data Protection Act 2023 · accessed Oct 2026
- Mondaq: NDPC issues the General Application and Implementation Directive 2025 · accessed Oct 2026
- Templars: enforcement framework under the Nigeria Data Protection Act 2023 · accessed Oct 2026
- Jones Day: Nigeria launches investigations into non-compliance with the NDPA 2023 · accessed Oct 2026
- TechCabal: Fidelity Bank fined N555.8 million for data infraction (Aug 2024) · accessed Oct 2026
- Mondaq: CBN data localisation directive for payment system participants · accessed Oct 2026
- The Guardian: FCCPC issues digital lending regulations · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.