AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
A contract with a Lagos customer support provider needs two halves. Service terms set measurable levels (hours covered in UK time, response and resolution targets, quality checks, reporting and service credits). Data terms cover the provider's duties as your processor under section 29 of the Nigeria Data Protection Act 2023, the UK transfer safeguard (an IDTA or the Addendum, with a transfer risk assessment, unless adequacy applies), breach notice, and deletion or return of data at the end.
Lagos has a growing market of support teams that answer email, chat and phone for UK businesses. The economics are attractive, and with Lagos on West Africa Time the working day overlaps closely with the UK's. The risk sits in the contract. A vague agreement leaves you with no lever when queues grow, and a weak data clause can leave your company in breach in two countries.
The service terms: write down what you will measure
Service levels only work if both sides can measure them from the same data. Agree the ticketing or phone system that is the source of truth, then set targets for each channel. Typical schedule items:
| Term | What to define |
|---|---|
| Coverage | Days and hours in UK time, including how the schedule moves when UK clocks change and on Nigerian and UK public holidays |
| First response | Target per channel, measured in business or clock hours |
| Resolution | Target by priority level, with your definitions of each level |
| Quality | Monthly sample of tickets scored against your checklist, and who scores |
| Staffing | Minimum trained agents per shift, notice before changing named team leads |
| Reporting | Weekly and monthly reports, in a fixed format |
| Service credits | Fee reductions if targets are missed, capped, and stated as not your only remedy |
| Escalation | Named contacts on both sides and response times for complaints |
The numbers are commercial; set them from your own volumes. If you are still deciding the shift pattern, see customer support across UK and Nigerian time zones.
The data terms: two laws at once
Your side: a UK restricted transfer
When your Lagos provider can see customer records held in the UK, the ICO treats that as a restricted transfer: personal information going to a separate organisation outside the UK. The ICO's guide, updated 15 January 2026, says the rules apply to all restricted transfers, even small, infrequent ones. Unless the destination is covered by UK adequacy regulations (check the ICO's current list), you need an appropriate safeguard, such as the International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum, and a transfer risk assessment showing the protection is not materially lower after the transfer. Exceptions under Article 49 are for narrow cases, not an ongoing support contract.
Their side: the NDPA
The provider processes data in Nigeria, so the Nigeria Data Protection Act 2023 applies to that processing (section 2(2)). Section 29 requires a written agreement between controller and processor and makes the processor meet obligations including security, help with data subject rights and telling you before engaging another processor. When the provider sends data back to you, or to a sub-processor outside Nigeria, sections 41 to 43 require a lawful basis for the transfer out of Nigeria, such as contractual clauses. Section 40 requires a controller to notify the NDPC within 72 hours of becoming aware of a breach likely to risk people's rights, so the contract should make the provider tell you much sooner than that. Background: the NDPA for UK businesses.
Clauses to include
- Process data only on your documented instructions, for support purposes only.
- Confidentiality undertakings from every agent.
- Named security measures: access controls, no personal devices, no local downloads, multi-factor sign-in.
- No sub-processors without your written approval.
- Breach notice to you within a short, fixed number of hours, with the facts needed for regulators.
- Help with access, correction and erasure requests.
- Audit and inspection rights.
- At the end: return or delete all data, and certify it in writing.
- The IDTA or Addendum attached, with the transfer risk assessment on file.
Employment risk: keep the line clear
Nigerian courts look at substance. In Wambai v Bourbon-Interoil (National Industrial Court, 2019), summarised by SimmonsCooper Partners for Legal 500, the end user was held to be a co-employer despite crew management agreements, although the Court of Appeal reversed a joint-employer finding in a different case where there was no direct relationship. To keep agents as the provider's employees, let the provider hire, pay, supervise and discipline them, and route instructions through its team leads. The provider carries the employer duties, including Employees' Compensation Act contributions to NSITF, which NSITF says cover contract, casual and outsourced workers; ask for evidence that it pays them.
Commercial and exit terms
- Fee basis (per agent, per hour or per ticket) and currency of invoice.
- Payment terms and how exchange movements are handled if fees are in pounds but costs are in naira.
- Governing law and where disputes are heard.
- Term, notice to end, and a transition period in which the provider helps move work to you or a new supplier.
- Ownership of knowledge bases, scripts and recordings created for you.
Where Pryme fits
Paying a Lagos provider is simpler from an account that holds both currencies: a Pryme Business Account can pay a naira invoice from naira or a sterling invoice from pounds, with Swap showing the rate and fee first. If you keep some support in-house, the Customer Support agent prepares replies for your team to approve, and payments sit in a clear trail for procure-to-pay controls.
Questions people ask
What should an outsourcing contract with a Nigerian call centre include?
Measurable service levels with reporting and service credits, a section 29 NDPA processor agreement, a UK transfer safeguard such as the IDTA, breach notice, audit rights and exit and deletion terms.
Is sending UK customer data to a Lagos provider a restricted transfer?
Yes. The ICO treats sending personal information to a separate organisation outside the UK as a restricted transfer, needing adequacy, an appropriate safeguard or a narrow exception.
Does the NDPA apply if my customers are all in the UK?
It applies to the provider's processing in Nigeria under section 2(2), including duties as a processor and rules on transferring data out of Nigeria.
Could I be treated as the employer of outsourced agents?
Possibly, if you control them directly. A National Industrial Court case found an end user to be a co-employer. Let the provider hire, pay and supervise its staff.
Sources
- ICO: International transfers, a guide (updated 15 Jan 2026) · accessed Oct 2026
- Nigeria Data Protection Act 2023 (KPMG copy of the Act) · accessed Oct 2026
- Legal 500 (SimmonsCooper Partners): Hired, fired and outsourced, Nigeria's employment maze (14 Jan 2025) · accessed Oct 2026
- NSITF: Employees' Compensation · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.