The Nigeria Data Protection Act 2023 gives people a right not to be subject to decisions based solely on automated processing, including profiling, that significantly affect them. An AI agent may make them only under an exception, such as contract, written law or consent, and with safeguards: human intervention, a chance to give a view, and a way to contest.
What does the NDPA require?
In substance, the NDPA provides that a data subject has the right not to be subject to a decision based solely on automated processing of personal data, including profiling, where the decision produces legal effects concerning them or similarly significantly affects them.
The right does not apply where the decision is:
- necessary for entering into or performing a contract between the data subject and the controller;
- authorised by written law that also sets suitable measures to protect the data subject's rights and interests; or
- based on the data subject's consent.
Where the contract or consent exceptions are used, the controller must put in place suitable measures, at least the rights to obtain human intervention, to express their point of view and to contest the decision.
The Act's general duties apply alongside: a lawful basis, fairness and transparency, accuracy, minimisation, and telling people about automated decision-making in privacy information. Processing likely to result in high risk, which significant automated decisions often are, calls for a data protection impact assessment.
Who does it apply to?
Controllers and processors established in Nigeria, and those outside Nigeria processing personal data of people in Nigeria. The Nigeria Data Protection Commission enforces it. Sector supervisors such as the CBN, SEC Nigeria and NAICOM apply their own conduct rules to the same decisions.
Which agent decisions are caught?
The test has three parts: a decision, made solely by automated means, with legal or similarly significant effects. Agents in the Nigerian market meet it most often in these places:
- Digital lending. An agent that approves, declines or sets the limit on a loan application in seconds, with no person involved.
- Account restrictions. An agent that places a restriction on an account or blocks a card on suspicion of fraud, leaving the customer unable to transact.
- Insurance claims. An agent that rejects a claim or reduces a settlement.
- Collections. An agent that decides to escalate an account to recovery action or report it to a credit bureau.
- Onboarding. An agent that rejects an account opening because identity checks did not match.
Decisions that are rarely caught: answering a balance enquiry, routing a complaint, reminding a customer about a due date, or drafting a decision that a person then makes after real review.
A frequent weak point is human review in name only. If a person approves a queue of agent decisions without examining them, the decision is still effectively solely automated.
How do you meet the requirement?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Identify solely automated significant decisions | Register of agent capabilities that decide about people, with effect rating | Capability register |
| Valid exception | Exception recorded per decision type: contract, written law or consent | Legal assessment per decision type |
| Consent, where relied on | Clear, specific consent captured and recorded before the decision | Consent records |
| Human intervention | Named person who can change the decision, reachable through a stated channel | Intervention log with outcomes |
| Point of view and contest | Customer can submit information and challenge; a person reviews | Challenge log |
| Transparency | Privacy information and decision messages explain the automated decision | Notice; message templates |
| Accuracy | Decisions draw on verified data from systems of record | Source configuration |
| Impact assessment | Assessment before go-live | Signed assessment |
| Meaningful review where claimed | Reviewers see full context; override rates tracked | Review records |
For a digital lender, contract necessity is the most common exception, but the lender must be able to show why a solely automated decision is necessary for the contract, not just convenient. Where that is hard to show, holding declines for a person is the safer design.
How does this compare with other regimes?
The NDPA follows the same structure as GDPR's Article 22; see what automated decision-making under GDPR is and whether GDPR allows AI agents to make automated decisions. South Africa's POPIA approaches it differently, as set out in POPIA automated decision-making and AI agents, and the UK has amended its rules, covered in ICO and automated decision-making by AI agents.
What will the NDPC or a sector supervisor ask?
- Which agent decisions about customers are made with no person involved?
- Which exception applies to each, and how did you establish it?
- How does a customer reach a person who can change the decision?
- What do you tell customers about automated decisions?
- Where is the impact assessment?
- How often do challenges succeed, and what do you change as a result?
What does the requirement not cover?
It does not ban automation. It does not apply to decisions about companies. It does not require human review of decisions without significant effects. It does not replace CBN, SEC Nigeria or NAICOM conduct rules, which apply to the same decisions. For the full map, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Is a temporary account restriction a significant decision?
It can be, if the customer cannot access money they need. A short restriction promptly reviewed by a person is a weaker case than one left in place for days. Design for quick human review.
Can a customer insist that a person decides from the start?
The right is to human intervention after the decision, plus the right not to be subject to such decisions unless an exception applies. A customer can object, and you should have a route for a person to decide.
Does credit bureau data make a decision automated?
No. What matters is whether a person is meaningfully involved in the decision, not where the data came from. Bureau data used by an agent deciding alone gives a solely automated decision.