AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
Yes, the Nigeria Data Protection Act 2023 can apply to you: section 2(2)(c) covers controllers and processors outside Nigeria that process personal data of people in Nigeria. As a contractor with access to a fintech's customer data you are normally its processor, so you must work under a written agreement, follow its instructions, keep the data secure, and tell the fintech promptly about any breach, because the fintech has 72 hours to notify the regulator.
Why a contractor abroad is in scope
Fintech contracting often means production access: database queries to fix a bug, logs containing account numbers, support tools showing BVNs or phone numbers. The NDPA reaches that work from abroad. Section 2(2) applies the Act where a controller or processor is domiciled, resident or operating in Nigeria, where processing happens in Nigeria, or, under section 2(2)(c), where a controller or processor not in Nigeria is processing personal data of a data subject in Nigeria.
In most contracts the fintech decides why and how data is processed (the controller) and you act on its behalf (the processor). If you start deciding purposes yourself, for example by copying data to build your own tool, you can become a controller with heavier duties.
Your duties as a processor
From the Act (KPMG's published copy):
- Section 29(1): a processor must meet the controller's obligations when engaged, assist with data subject rights, implement the security measures in Part VII, give the controller information to show compliance, and notify the controller when engaging another processor.
- Section 29(2): the engagement must be under a written agreement.
- Section 39: appropriate security, which the Act illustrates with measures such as encryption, pseudonymisation and testing.
- Section 40(1): a processor must notify the controller on becoming aware of a breach. Under section 40(2) the controller must notify the Commission within 72 hours where the breach is likely to put individuals at risk, and under 40(3) inform affected people where the risk is high.
- Section 41: personal data should not be transferred out of Nigeria unless there is an adequate level of protection, through law, binding rules, contractual clauses, a code of conduct or certification, or one of the section 43 grounds.
Section 29 does not itself mention returning or deleting data at the end of the engagement; erasure is dealt with in section 34(2). Put deletion in the contract so there is no doubt.
Your own law may apply as well
If you work from the UK or the EU, local data protection law can also apply to what you do. The UK GDPR's Article 28, for example, sets out what a processor contract must cover. A contract that meets both is usually achievable, because the requirements overlap.
Why the fintech will push hard on this
The penalties fall heavily on the fintech. Section 48 sets a maximum of the greater of ₦10 million or 2% of annual gross revenue for a data controller or processor of major importance, and the greater of ₦2 million or 2% for others. The NDPC's 2025 General Application and Implementation Directive (Article 8(2)) also says an organisation of major importance need not be domiciled or resident in Nigeria where it targets data subjects in Nigeria. Expect due diligence questions, security requirements and audit clauses; answer them in writing.
Contract terms to agree
| Term | What to agree |
|---|---|
| Instructions | You process only on the fintech's documented instructions |
| Access | Least privilege, named accounts, through the client's VPN or virtual desktop, no shared logins |
| Location | Where you work from, and whether data may leave Nigeria or the client's systems |
| Breach notice | A short window, for example 24 hours from awareness, so the client can meet its 72 hours |
| Sub-processors | No subcontractors without written approval |
| End of contract | Return or delete data and confirm in writing |
| Liability | Capped, and matched to your insurance |
Safe working habits
- Never copy production data to your laptop, personal cloud or AI tools. Use masked or synthetic data for testing.
- Use the client's systems for any access to live data; log out and lock screens.
- Turn on full-disk encryption and an authenticator app for every client account.
- Report anything odd immediately, even if you are not sure it is a breach.
- Keep a short record of what data you accessed and why, if the client asks.
Worked example
Example only. A Berlin-based backend developer is contracted by an Abuja payments start-up to fix a reconciliation bug. She needs read access to transaction tables containing names and account numbers. The contract names her as processor, limits access to a virtual desktop on the client's cloud, bars downloads, and requires breach notice within 24 hours. She tests her fix on a masked copy prepared by the client's team. At the end, her access is revoked and she confirms in writing that she holds no client data.
Where Pryme fits
Pryme Business Accounts include a Compliance agent that can keep a register of client data agreements and their deletion dates; it prepares, a person approves. Pryme accounts use an authenticator app rather than SMS codes (security). Insurance for this kind of work is covered in professional indemnity for Nigerian projects, and confidentiality terms in NDAs with Nigerian companies. For the rights of the people whose data you handle, see data rights under the NDPA.
Questions people ask
Does the NDPA apply to me if I live abroad?
It can. Section 2(2)(c) applies the Act to controllers and processors outside Nigeria that process personal data of people in Nigeria.
Am I a data controller or processor as a contractor?
Usually a processor, because the fintech decides why and how the data is used. If you start deciding purposes yourself, you can become a controller.
How fast must a data breach be reported under the NDPA?
The processor must tell the controller on becoming aware of it, and the controller must notify the Commission within 72 hours where there is a likely risk to individuals.
Can I copy customer data to my laptop to debug?
Avoid it. Use the client's systems and masked data; copying live data out widens the risk and may count as a transfer out of Nigeria under section 41.
Sources
- Nigeria Data Protection Act 2023 (KPMG copy) · accessed Oct 2026
- NDPC: General Application and Implementation Directive (GAID) 2025 · accessed Oct 2026
- legislation.gov.uk: UK GDPR Article 28 (processor) · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.