Every personal data duty in the Nigeria Data Protection Act 2023 applies when an AI agent handles personal data of people in Nigeria. The deploying firm is the controller and needs a lawful basis per purpose; the platform is a processor under written terms. Transfers abroad need a basis, rights must reach agent memory, and breaches go to the NDPC.
What does the NDPA require?
The NDPA, enforced by the Nigeria Data Protection Commission, sets out principles and duties in substance:
- Principles: personal data processed lawfully, fairly and transparently; collected for specified, explicit and legitimate purposes; adequate, relevant and limited to what is necessary; accurate; kept no longer than necessary; secured; and handled with accountability.
- Lawful bases: consent, contract, legal obligation, vital interests, public interest or official authority, and legitimate interests.
- Sensitive personal data: stricter conditions for data such as health, ethnicity, religion and biometrics.
- Rights: information, access, rectification, erasure, restriction, portability, objection, and the right not to be subject to solely automated decisions with significant effects.
- Controllers and processors: processors act under written terms; controllers remain responsible.
- Impact assessments: required for processing likely to result in high risk.
- Security and breaches: appropriate measures; personal data breaches notified to the Commission promptly and to data subjects where risk is high.
- Transfers: personal data may leave Nigeria only where the recipient country or arrangement provides adequate protection, or another permitted basis applies.
- Data controllers of major importance: registration and extra duties, including a data protection officer.
Who does it apply to?
Controllers and processors established in Nigeria, and those outside Nigeria that process personal data of people in Nigeria. A foreign agent platform serving a Nigerian bank is reached as a processor through the bank, and potentially directly.
What does the NDPA mean when the system is an agent that acts?
Purposes multiply with capabilities. An agent that started answering account questions and now also prepares loan top-up offers serves two purposes. Each needs a lawful basis and must be in the privacy notice.
Inferences are personal data. An agent that notes a customer "may be struggling financially" or "appears to have a health issue" has created personal data, possibly sensitive. Restrict what an agent may record about people, and treat any such note as data the customer can ask to see.
Processing often crosses borders. Many platforms and model providers process data outside Nigeria. Record the transfer basis for each destination before data flows, and limit what is sent, for example by stripping identifiers that the model does not need.
Breaches can come from the agent itself. An agent manipulated into disclosing another customer's details, or one that emails a statement to the wrong address, causes a personal data breach. Incident processes must recognise agent-caused breaches.
These points sit beside the sector view in AI agents for compliance teams in healthcare in Nigeria, where health data adds sensitive-data conditions.
How do you meet the NDPA?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Lawful basis per purpose | Each agent capability mapped to a purpose and basis | Records of processing |
| Transparency | Privacy notice describes agent jobs and any automated decisions | Notice versions |
| Minimisation | Agent sees only fields its capability needs | Access maps |
| Sensitive data | Agents without a condition cannot see sensitive data; disclosures routed to people | Masking rules; routing logs |
| Processor terms | Written contract with platform and sub-processors | Signed contracts |
| Impact assessment | Assessment for high-risk agent processing | Signed assessments |
| Transfers | Basis recorded for each foreign destination | Transfer assessments |
| Rights | Requests reach memory, history, summaries and logs | Request files |
| Retention | Periods set for agent memory and history | Retention schedule; deletion logs |
| Breach handling | Agent incidents assessed and notified | Breach register |
| Registration where required | Registration as a controller of major importance if thresholds met | Registration record |
Whether you need an impact assessment for a given agent is covered in do AI agents need a data protection impact assessment, and whether an agent can help write one in can an AI agent draft a data protection impact assessment.
What will the NDPC ask?
- What personal data do your agents process, for which purposes, on which basis?
- Who are your processors and sub-processors, and where are they?
- On what basis does agent data leave Nigeria?
- Have you assessed high-risk agent processing?
- Show us how an erasure request reached agent memory.
- How would you detect and report a breach caused by an agent?
What does the NDPA not cover?
It does not regulate the commercial quality of agent outputs or financial conduct; the CBN, SEC Nigeria and NAICOM do. It does not replace sector rules on data location. Comparable regimes in other markets differ in detail; see UAE Personal Data Protection Law and AI agents and DIFC Data Protection Law and AI agents. For the full map, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
In Pryme, an agent can only reach the sources named in its brief, and the minimum chain checks role scope and sources at the moment of every action. Facts carry provenance, so a customer's statement is marked declared rather than treated as verified. Every verdict is filed in an append-only record, which supports both rights requests and breach investigation.
Questions people ask
Is a foreign agent platform subject to the NDPA?
If it processes personal data of people in Nigeria, the NDPA can reach it. In practice it is bound mainly through its processor contract with the Nigerian controller.
Is consent the safest basis for agent processing?
Not necessarily. Consent can be withdrawn and must be freely given. For customer service under an account agreement, contract is often more appropriate. Choose the basis that matches the purpose.
Must we tell customers they are speaking with an AI agent?
The NDPA requires transparency about processing, including automated decision-making. Telling customers when an agent is handling their request is the clearest way to meet that and avoids misleading them.