AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
A US company is covered by the Nigeria Data Protection Act 2023 when it processes personal data of people in Nigeria, even with no office there (s.2(2)(c)). It must register with the NDPC only if it is a data controller or processor "of major importance"; the NDPC's GAID 2025 says such a controller may not be domiciled or resident in Nigeria where it targets people there. Tiered controllers also designate a DPO and file annual compliance audit returns, due by 31 March for older organisations.
Two questions, not one
US founders often ask "do I need to register in Nigeria?" as if it were the same question as "does Nigerian data law apply to me?". It is not. The Act can apply to you without any registration duty, and the duties that apply to everyone (lawful basis, notices, security, breach reporting, transfer rules) do not depend on registering.
| Question | Where the answer comes from |
|---|---|
| Does the NDPA apply? | NDPA 2023 s.2(2): controllers or processors domiciled, resident or operating in Nigeria; processing in Nigeria; or not in Nigeria but processing data of a data subject in Nigeria |
| Must we register with the NDPC? | Only if designated of major importance: NDPA s.44 and GAID 2025 Articles 8 and 9 |
| Must we file a compliance audit return? | GAID 2025 Article 10, by tier |
| Must we appoint a DPO? | GAID 2025 Articles 7(i) and 11, for major-importance controllers and processors |
What "major importance" means
GAID 2025 Article 8(1) describes a controller or processor of major importance as one processing personal data of more than a number of data subjects in Nigeria that the Commission prescribes, or data of particular value to Nigeria's economy, society or security. Article 8(2) adds that such a controller "may not be domiciled in or resident in Nigeria" where it targets data subjects in Nigeria, which is the line that reaches US companies. Article 8(4) creates three tiers: Ultra-High Level (UHL), Extra-High Level (EHL) and Ordinary-High Level (OHL). The numbers and fees sit in Schedule 7 of the GAID.
A Templars summary published on Mondaq in January 2026 describes the tiers this way; check against Schedule 7 before relying on it:
| Tier | Who, per the Templars summary (Jan 2026) |
|---|---|
| UHL | Sectors such as banks, telecoms, insurers, fintechs and payment gateways, and any organisation processing data of more than 5,000 data subjects within six months |
| EHL | Bodies such as government agencies, microfinance banks, higher institutions and hospitals, and organisations processing more than 1,000 but fewer than 5,000 data subjects within six months |
| OHL | The third tier; check Schedule 7 for its criteria and fees |
What registration involves
- Registration: UHL and EHL register once and then file a compliance audit return (CAR) each year; OHL renews registration annually and does not file a CAR on renewal (GAID Art 9(2)-(3)).
- CAR deadline: organisations established before 12 June 2023 file not later than 31 March each year; those established after file within 15 months of establishment, then annually (Art 10(7)-(8)).
- Who files: UHL and EHL file through a licensed Data Protection Compliance Organisation (DPCO) unless the Commission approves otherwise, on the NDPC's platform (Art 10(12), 10(14)).
- DPO: designate one, staff or contracted, publish the contact details and notify the Commission (Art 11).
- Late filing: the Templars summary reports an extra charge of up to 50% of the filing fee, and up to the greater of 2% of annual gross revenue or ₦10 million for not filing.
We did not find fee amounts in the parts of the GAID we could read, so check Schedule 7 or ask a licensed DPCO for the current figures. The GAID text we read contains no explicit requirement for a foreign company to appoint a local representative.
A worked example
Example only. A Delaware company runs a remittance-tracking app with 12,000 users in Nigeria, signed up over the past year. It has no Nigerian office. It processes data of data subjects in Nigeria, so the NDPA applies (s.2(2)(c)). With more than 5,000 data subjects in six months, the Templars reading would put it in the UHL tier, and as a fintech it fits the sector list too. It would register once, appoint a DPO, file a CAR through a DPCO each year by 31 March (or within 15 months if established after 12 June 2023), and report any risky breach within 72 hours. A US SaaS tool with 300 Nigerian users would still owe the general duties but would not, on those numbers, meet the six-month counts in the summary.
Duties that apply whether or not you register
- A lawful basis for each purpose (s.25): consent, contract, legal obligation, vital interests, public task or legitimate interests.
- A privacy notice at collection covering identity, purposes, recipients, rights, retention and the right to complain to the Commission (s.27).
- Security measures appropriate to the risk (s.39).
- Breach notice to the NDPC within 72 hours where there is risk, and to people where it is high (s.40). See cybersecurity for a Lagos office.
- Transfers out of Nigeria only on an adequacy basis or one of the s.43 grounds, with a record of the basis (s.41).
The NDPC FAQ says the Commission can impose a remedial fee of up to the greater of ₦10,000,000 or 2% of annual gross revenue for a controller of major importance, and ₦2,000,000 or 2% for others. For staff data, see data protection for Nigerian staff and customers; readers in Nigeria can see their rights under the NDPA.
What to do first
- Count active Nigerian data subjects over the last six months, by product.
- Check the count and your sector against GAID Schedule 7.
- If you are in a tier, engage a licensed DPCO and appoint a DPO.
- Whatever the answer, update the privacy notice, the transfer record and the breach plan.
- Keep a dated memo of the decision. This is information, not legal advice.
Where Pryme fits
For a US company with a Nigerian team or customers, a Pryme Business Account can hold NGN and USD for fees and payroll. The Compliance agent can track the 31 March return and DPO tasks; a person approves anything above a set ceiling.
Questions people ask
Does the NDPA apply to a company outside Nigeria?
Yes, where it processes personal data of people in Nigeria, under NDPA 2023 s.2(2)(c).
Does a US company have to register with the NDPC?
Only if it is a data controller or processor of major importance. GAID 2025 Article 8(2) says such a controller may be outside Nigeria where it targets people in Nigeria.
When is the NDPC compliance audit return due?
By 31 March each year for organisations established before 12 June 2023; within 15 months of establishment for later ones, then annually (GAID Art 10).
What are UHL, EHL and OHL?
The three GAID 2025 tiers of major-importance controllers: Ultra-High, Extra-High and Ordinary-High Level. Thresholds and fees are in Schedule 7.
Sources
- Nigeria Data Protection Act 2023 (KPMG Nigeria copy) · accessed Oct 2026
- NDPC: Nigeria Data Protection Act General Application and Implementation Directive (GAID) 2025 · accessed Oct 2026
- Mondaq (Templars): Data protection compliance in Nigeria, audit return obligations for 2026 (28 Jan 2026) · accessed Oct 2026
- NDPC: Frequently asked questions · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.