AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
Under the Nigeria Data Protection Act 2023, personal data should not be transferred out of Nigeria unless the recipient is subject to adequate protection, through a law, binding corporate rules, contractual clauses, a code of conduct or certification, or one of the s.43 exceptions such as informed consent or performance of a contract applies. You must record the basis for each transfer. Staff data such as health details is sensitive and needs extra care.
If you run a Nigerian business from abroad, staff data leaves Nigeria constantly: payroll files emailed to you, HR records in a cloud system hosted elsewhere, CVs shared with your company abroad. The Nigeria Data Protection Act 2023 (NDPA) treats each of these as a cross-border transfer. Here is what the Act says, and what to put in place.
Does the NDPA apply to you?
Section 2(2) applies the Act where the controller or processor is domiciled, resident or operating in Nigeria, where processing happens in Nigeria, or where a controller outside Nigeria processes data of a data subject in Nigeria. A Nigerian company employing staff in Nigeria is caught, and so is your company abroad when it handles their data.
The transfer rule
Sections 41 to 43 set the framework:
- Adequate protection (s.41(1)): a transfer is allowed if the recipient is subject to a law, binding corporate rules, contractual clauses, a code of conduct or a certification mechanism giving adequate protection.
- No decision is not a finding: s.42(6) says the absence of a Commission decision on a country does not mean it is adequate.
- Exceptions (s.43): where there is no adequate protection, transfer is permitted where the data subject consents after being told the risks, where it is needed to perform a contract with the data subject, for their sole benefit, for important public interest, for legal claims, or to protect vital interests.
- Record (s.41(2)): the controller must record the basis for the transfer.
For regular staff data flows, consent is a weak basis: staff may not feel free to refuse, and consent can be withdrawn. Contractual clauses with the recipient are the more stable route for routine HR and payroll transfers.
Common staff data flows
| Flow | Typical basis to consider | Notes |
|---|---|---|
| Payroll file sent to owner or parent abroad | Contractual clauses with the parent; contract with employee for pay | Send only what is needed |
| Cloud HR or accounting system hosted abroad | Contractual clauses with the provider as processor | Check the provider's terms and data location |
| Staff health data for insurance | Sensitive data: needs a s.30 ground as well | Limit who can see it |
| CVs shared with recruiters abroad | Consent after explaining risks, or clauses | Delete when no longer needed |
Sensitive data and risk assessments
Section 65 defines sensitive personal data to include health, biometric data used for identification, religious beliefs, racial or ethnic origin, political opinions, trade union membership and sex life. Section 30 limits processing of sensitive data to specific grounds such as explicit consent or employment law obligations. Section 28 requires a data protection impact assessment before processing likely to result in high risk, such as staff monitoring or biometric attendance systems.
Registration and audit returns
GAID 2025 sets categories of data controllers and processors of major importance. Templars, writing on Mondaq in January 2026, describes the ultra-high and extra-high levels as covering banks, telcos, insurers and fintechs, and any organisation processing data of more than 5,000 data subjects in six months (ultra-high), or between 1,000 and 5,000 (extra-high), with compliance audit returns due by 31 March each year through a licensed compliance organisation. A small employer may still fall in a category if it processes customer data at volume. Late filing can attract up to 50% more of the filing fee, according to the same summary.
Steps
- Map every flow of staff data out of Nigeria: who sends it, to whom, why, in what system.
- Choose and record a basis under s.41 or s.43 for each.
- Sign data transfer clauses with your company abroad and with processors that host data abroad.
- Tell staff, in their privacy notice, that data may be processed outside Nigeria and why.
- Minimise: send pay totals rather than full files where you can.
- Secure it: access controls, encryption and no personal email accounts for HR files.
- Check whether you need to register or file an audit return with the NDPC.
The other side
The country where you live has its own rules for data you receive and pass on. In the UK, the ICO says sending data to your own employee abroad, within the same legal entity, is not a restricted transfer, but remote access by a separate organisation is. Your Nigerian company and your foreign company are separate organisations, so both sets of rules can apply. Our wider guide is NDPA compliance for a Nigerian company run from abroad; staff rights are summarised in your data rights under the NDPA.
Where Pryme fits
The Compliance agent on a Pryme Business Account can keep the transfer register and remind you of renewal and filing dates, and payroll run from the account reduces the number of staff files that need emailing at all. A person approves above a set ceiling.
Questions people ask
Can I send Nigerian employees' data to my company abroad?
Yes, if the transfer has a basis under the NDPA: adequate protection through law, binding corporate rules, contractual clauses, a code of conduct or certification (s.41), or an exception in s.43. Record the basis.
Is staff consent enough to transfer data abroad under the NDPA?
Consent after the risks are explained is one s.43 exception, but for routine HR transfers contractual clauses are usually more reliable, because staff may not feel free to refuse and can withdraw consent.
Is health data treated differently?
Yes. Health is sensitive personal data under s.65, and s.30 limits its processing to specific grounds such as explicit consent or employment law obligations.
When is the NDPC audit return due?
GAID 2025 sets 31 March each year for organisations in the major importance categories, filed through a licensed data protection compliance organisation.
Sources
- Nigeria Data Protection Act 2023 (KPMG copy of the Act) · accessed Oct 2026
- NDPC, General Application and Implementation Directive (GAID) 2025 · accessed Oct 2026
- Mondaq (Templars), Data protection compliance in Nigeria: audit return obligations for 2026 (28 Jan 2026) · accessed Oct 2026
- ICO, International transfers: quick reference FAQs (15 Jan 2026) · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.