AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
Under the Nigeria Data Protection Act 2023 and the NDPC's 2025 implementation directive (GAID), businesses classed as data controllers or processors of major importance must register with the Nigeria Data Protection Commission and, for the higher tiers, file a compliance audit return through a licensed DPCO by 31 March each year. Failing to file can attract a penalty of up to 2% of annual gross revenue or ₦10 million, whichever is greater.
Which law and which rules
The Nigeria Data Protection Act 2023 (NDPA) set up the Nigeria Data Protection Commission (NDPC) and the duties for anyone who collects or uses personal data. In March 2025 the NDPC issued the General Application and Implementation Directive (GAID), which became operational in September 2025 and fills in the practical detail: who registers, how often and what must be filed.
Every business that handles personal data must follow the Act's principles. Registration and audit filing apply to a narrower group: data controllers and data processors of major importance.
Are you of major importance?
The GAID sorts these organisations into three tiers. A January 2026 summary by Templars describes the top two as follows:
| Tier | Who falls in it (examples) | Volume test |
|---|---|---|
| Ultra-High Level (UHL) | Commercial banks, telecoms, insurers, multinationals, DisCos, oil and gas companies, payment gateways, fintechs | Personal data of more than 5,000 people within six months |
| Extra-High Level (EHL) | Government MDAs, microfinance banks, higher institutions, secondary and tertiary hospitals, mortgage banks | More than 1,000 but fewer than 5,000 people within six months |
| Ordinary-High Level (OHL) | Smaller organisations still of major importance | Check the GAID schedule |
A busy school, clinic, estate agency or online shop can cross the 1,000-person line faster than its owners expect, because customers, staff, parents and suppliers all count as data subjects.
Registration and yearly filing
- Registration: UHL and EHL organisations register once; OHL organisations renew annually, according to a May 2025 summary of the GAID.
- Compliance audit return (CAR): due on or before 31 March each year, covering the previous year's processing, filed on the NDPC portal through a licensed Data Protection Compliance Organisation (DPCO).
- Data protection officer: the GAID requires one.
- Breaches: notify the NDPC within 72 hours of becoming aware of a breach likely to put people's rights at risk.
Penalties
Late filing of a CAR attracts an extra administrative fee of up to 50% of the applicable filing fee. Not filing at all can bring a fine of up to 2% of the previous year's annual gross revenue or ₦10,000,000, whichever is greater.
Under section 48 of the Act, the NDPC can also order a business to remedy a breach, pay compensation, account for profits and pay a remedial fee: for organisations of major importance, up to the greater of ₦10,000,000 or 2% of annual gross revenue; for others, the greater of ₦2,000,000 or 2%.
Worked example
Example only: a fintech with ₦800,000,000 in annual gross revenue skips its CAR. 2% of ₦800,000,000 is ₦16,000,000, which is greater than ₦10,000,000, so the maximum exposure is ₦16,000,000. A firm with ₦300,000,000 revenue faces up to ₦10,000,000, because 2% (₦6,000,000) is the smaller figure.
Steps for a small business
- List every place you hold personal data: customer records, payroll, CCTV, WhatsApp chats, forms.
- Count data subjects over a six-month window and match yourself to a tier.
- Register on the NDPC portal if you are of major importance, and appoint a data protection officer.
- Engage a licensed DPCO in good time to prepare the CAR for 31 March.
- Write a breach plan so a 72-hour notice is possible.
- Tell customers what you collect and why; see your data rights under the NDPA for what they can ask of you.
Where Pryme fits
Business accounts on Pryme include a Compliance agent built by Pryme Intelligence. It can prepare checklists and reminders such as your 31 March filing date; a person approves actions above a set ceiling and every action is recorded. It does not replace a licensed DPCO. The wider agent set is on Chief of Staff.
Questions people ask
Do all businesses in Nigeria need to register with NDPC?
No. Registration applies to data controllers and processors of major importance under the NDPA and the GAID. All businesses must still follow the Act's data protection principles.
When is the NDPC compliance audit return due?
On or before 31 March each year, covering the previous year's processing, filed through a licensed DPCO on the NDPC portal.
What is the penalty for not filing NDPC audit returns?
Up to 2% of the previous year's annual gross revenue or ₦10 million, whichever is greater, according to a January 2026 Templars summary. Late filing adds up to 50% of the filing fee.
How much is NDPC registration fee?
Fees vary by tier and are set in GAID tables. Confirm the current amount on the NDPC portal, as the published summaries we checked did not reproduce the figures.
Sources
- Data protection compliance in Nigeria: audit return obligations for 2026 (Templars via Mondaq, 28 Jan 2026) · accessed Oct 2026
- Key regulatory updates under the 2025 GAID (Mondaq, 21 May 2025) · accessed Oct 2026
- NDPC frequently asked questions · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.