AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
Under the ICO's guidance, giving your own employees in Nigeria access to UK customer data is not a restricted transfer, because you and they are the same legal entity, though you must still secure it. Sharing with a separate organisation in Nigeria, such as a contractor's company, an employer of record or your own Nigerian subsidiary, is a restricted transfer, so you need UK adequacy regulations, a safeguard such as the IDTA with a transfer risk assessment, or an exception.
The ICO's three-step test
The ICO's brief guide to international transfers (updated 15 January 2026) says a restricted transfer happens when all three of these are true:
- The UK GDPR applies to your processing of the information.
- You are initiating the transfer.
- The recipient is a separate legal entity from you, outside the UK.
"Transfer" includes making information accessible, not just sending it. The ICO's FAQs give the example of allowing an organisation outside the UK remote access to personal information held on your UK systems. The rules apply to small and infrequent transfers too.
Who is on which side of the line
| Who in Nigeria gets access | Restricted transfer? | Why |
|---|---|---|
| Your own employee, employed by your UK company | No | Same legal entity (ICO FAQs) |
| An employee working on a company device while travelling | No | ICO FAQs say this is not a restricted transfer |
| Staff employed by an employer of record | Likely yes | The employer of record is a separate entity |
| Your Nigerian subsidiary | Likely yes | A subsidiary is a separate company |
| A contractor trading through their own company | Likely yes | Separate legal entity |
| A Nigerian outsourcing or support firm | Yes | Separate organisation |
The ICO's FAQs do not deal specifically with individual freelancers. Applying the three-step test, a self-employed contractor is a separate person from your company, so treat access by a contractor as a restricted transfer unless your adviser says otherwise.
Your own employees: security still applies
Not being a restricted transfer does not mean no rules. The ICO's FAQs say you must put in place appropriate security measures to prevent unauthorised access. In practice that means company-managed devices, multi-factor sign-in, access limited to what each role needs, and a clear process when someone leaves. The controls are in cyber security for a UK and Nigeria team.
Separate organisations: the three routes
1. Adequacy regulations
If the UK has made adequacy regulations for a country, no further safeguard is needed. The ICO's adequacy page (updated 30 July 2026) links to the current list. We could not confirm that Nigeria is on it, so plan on the next route and check the list before you rely on adequacy.
2. Appropriate safeguards
The usual safeguard for a small business is the International Data Transfer Agreement (IDTA), signed between your company and the Nigerian recipient. If you rely on a safeguard, the ICO says you must complete a transfer risk assessment, which UK legislation now calls a "data protection test", to check that protection is not materially lower. The detail is in the IDTA for Nigerian staff access.
3. Exceptions
Exceptions, such as explicit consent, apply only where neither adequacy nor a safeguard covers the transfer, and you generally must show the exception is necessary and proportionate. They are not designed for routine, ongoing access by a support team.
A worked scenario
A UK online retailer has six customer support staff in Lagos. Four are employed directly by the UK company on Nigerian contracts; two are freelancers who invoice through their own small companies. All six log in to the retailer's helpdesk, hosted in the UK, to answer customer emails.
- The four employees are part of the same legal entity, so their access is not a restricted transfer. The retailer still needs appropriate security: managed laptops, multi-factor sign-in and role-based access.
- The two freelancers' companies are separate entities. Their remote access to the helpdesk is a restricted transfer. Unless adequacy covers Nigeria, the retailer signs an IDTA with each company and completes a transfer risk assessment.
- All six process data in Nigeria, so the Nigerian Act is relevant as well, and the freelancers' agreements should cover processor duties.
If the retailer later moves all six into an employer of record, every one of them becomes a restricted transfer, and the IDTA would be signed with the employer of record.
Nigerian law applies too
The Nigeria Data Protection Act 2023 applies to processing carried out in Nigeria (section 2(2)). A Nigerian contractor or company processing your UK customers' data is processing in Nigeria, and section 29 sets duties for processors, including a written agreement. The employer side is covered in the NDPA and staff data.
Reduce what you share
- Give each person access only to the systems their role needs.
- Mask card numbers, dates of birth and other fields support staff do not need.
- Keep data in your UK systems and give access, rather than exporting spreadsheets.
- Log access and review it quarterly.
Where Pryme fits
Pryme Business Accounts come with a Compliance agent that can keep a register of who has access to what and when agreements are due for review, and a Customer Support agent that prepares replies for a person to approve. Account security uses an authenticator app rather than SMS codes.
Questions people ask
Is giving Nigerian employees access to UK data an international transfer?
Not a restricted transfer, the ICO says, when they are employees of your UK company, because you are the same legal entity. You still need appropriate security.
Does a Nigerian contractor need an IDTA?
A contractor is a separate person or company, so access is likely a restricted transfer, and the IDTA with a transfer risk assessment is the usual safeguard.
Is Nigeria covered by UK adequacy regulations?
We could not confirm it. Check the ICO's adequacy page for the current list before relying on adequacy.
Does remote access count as a transfer?
Yes. The ICO says making information accessible, including remote access by an organisation outside the UK, is a transfer.
Sources
- ICO: A brief guide to international transfers (updated 15 Jan 2026) · accessed Oct 2026
- ICO: International transfers, quick reference FAQs (15 Jan 2026) · accessed Oct 2026
- ICO: Adequacy regulations (updated 30 Jul 2026) · accessed Oct 2026
- Nigeria Data Protection Act 2023 (KPMG copy) · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.