AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
Under section 17 of Quebec's private sector privacy act, as amended by Law 25, a business must carry out a privacy impact assessment before communicating personal information outside Quebec, including to its own staff or a provider in Nigeria. The assessment weighs the sensitivity of the data, the purpose, the protection measures and the legal framework in the destination; the transfer may go ahead only if the data would receive adequate protection, and it must be covered by a written agreement that reflects the assessment.
What the law requires
Quebec's Act respecting the protection of personal information in the private sector (chapter P-39.1), amended by the law widely known as Law 25, sets the rule in section 17. Before communicating personal information outside Quebec, an enterprise must conduct a privacy impact assessment (PIA). The same requirement applies when it entrusts a person or body outside Quebec with collecting, using, communicating or keeping the information on its behalf. The text we read on LégisQuébec is updated to 20 February 2024.
For a Quebec business with a support team in Lagos, an accounts clerk in Abuja or developers in Port Harcourt who can see customer records, that means the PIA comes first, before the access is switched on.
What the assessment must weigh
Section 17 lists four factors:
- the sensitivity of the information
- the purposes for which it will be used
- the protection measures, including contractual ones, that will apply
- the legal framework applicable in the state where the information would be communicated
The transfer may go ahead only if the assessment shows the information would receive adequate protection. It must then be covered by a written agreement that takes account of the results of the assessment and, where relevant, the agreed measures to reduce the risks identified.
Assessing Nigeria's legal framework
The fourth factor asks you to look at Nigerian law. The main statute is the Nigeria Data Protection Act 2023, overseen by the Nigeria Data Protection Commission. Points a PIA will usually note:
- The NDPA sets principles, lawful bases and security duties for controllers and processors (ss.24, 25 and 39).
- A processor must notify the controller of a breach, and the controller must notify the Commission within 72 hours where there is a likely risk (s.40).
- Transfers out of Nigeria are restricted (ss.41 to 43). That matters when your Nigerian staff send data back to Quebec, or create new personal data in Nigeria, such as records about Nigerian customers.
- Penalties under s.48 can reach the greater of ₦10 million or 2% of gross revenue for data controllers of major importance.
The PIA should also record practical facts: who in Nigeria can see what, on which devices, whether data is stored there or only viewed, and how access ends when someone leaves. The Nigerian side in more depth: the Nigeria Data Protection Act for a Canadian company.
A practical PIA for remote staff
| Question | Example answer for a Lagos support team |
|---|---|
| What data? | Customer names, emails, order history; no payment card numbers |
| Why? | To answer support tickets |
| Where is it stored? | On the Quebec company's systems; staff view it through a secure portal, no local copies |
| Who has access? | Named staff, role-based, with multi-factor sign-in |
| Contract? | Employment or service contract with confidentiality and data clauses |
| Nigerian law? | NDPA 2023 applies to processing in Nigeria |
| Residual risk? | Device loss; mitigated by managed devices and remote wipe |
Scale the depth to the risk. Section 3.3 of the same act says, for PIAs on information system projects, that the assessment should be proportionate to the sensitivity of the information, the purpose, the quantity, the distribution and the medium. Health or identity documents call for more care than names and order numbers.
Common gaps
The gaps that appear most in small firms are practical: staff in Nigeria using personal laptops, customer exports saved to shared drives, and access left open after someone leaves. A PIA that says "no local copies" needs a control that makes it true, such as managed devices and a portal that blocks downloads. Write the control into the PIA and test it.
The written agreement
- What data is shared and for what purpose
- Security measures the recipient must apply
- Confidentiality and limits on further sharing
- Breach notice to the Quebec business without delay
- Return or destruction at the end of the arrangement
- Right to audit or receive compliance information
Where the people in Nigeria are employees of your Nigerian subsidiary, put this in an intercompany data agreement as well as their contracts. For a business based in another province, the federal rules are covered in PIPEDA and data sent to staff in Nigeria.
What to check first
- Who your person in charge of the protection of personal information is; section 3.3 expects that person to be consulted from the start of a project.
- An inventory of what data Nigerian staff will touch.
- The PIA, signed off and kept on file.
- The written agreement, signed before access starts.
- A review date, and a fresh PIA if the data or the arrangement changes.
Where Pryme fits
Payments to Nigerian staff and suppliers carry personal data too. In a Pryme Business Account, the Compliance agent can prepare a draft data inventory and checklist for your review, and actions in the account are recorded. Pryme does not replace your PIA or legal advice.
Questions people ask
Does Law 25 apply to sending data to my own staff in Nigeria?
Yes. Section 17 applies to communicating personal information outside Quebec and to entrusting someone outside Quebec with it, which covers staff or providers in Nigeria.
What does a privacy impact assessment for a transfer cover?
The sensitivity of the data, the purposes, the protection measures including contracts, and the legal framework of the destination.
Is a written agreement required for transfers out of Quebec?
Yes. The communication must be covered by a written agreement that reflects the assessment's results and risk measures.
Which Nigerian law should the assessment consider?
The Nigeria Data Protection Act 2023, including its security, breach and cross-border transfer rules.
Sources
- LégisQuébec: Act respecting the protection of personal information in the private sector, P-39.1, ss.3.3 and 17 (updated to 20 Feb 2024) · accessed Oct 2026
- Nigeria Data Protection Act 2023 (KPMG copy) · accessed Oct 2026
- NDPC: Nigeria Data Protection Commission · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.