The Nigeria Data Protection Act 2023 makes data controllers accountable for every use of personal data, including by AI agents, and gives people a right not to be subject to solely automated decisions with significant effects. Staff in Nigerian banks, lenders and insurers must be trained to keep agents within purpose, protect identity data, review significant decisions and report breaches.
What does the Act ask of staff who work with agents?
The Act sets principles for processing personal data. In substance, processing must be lawful, fair and transparent; for specified purposes; adequate and limited to what is necessary; accurate; kept no longer than needed; and secure. The controller must be able to show compliance. Each processing activity needs a lawful basis, such as consent, contract, legal obligation or legitimate interest. Sensitive personal data, including health, religious and biometric data, faces stricter conditions.
People have rights to information, access, correction, erasure, restriction, objection and portability, and a right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, with limited exceptions and safeguards. Where processing is likely to result in high risk, such as automated decisions or large-scale profiling, the controller must carry out a data protection impact assessment before it starts. Controllers must notify the Nigeria Data Protection Commission of breaches likely to risk people's rights, and tell those people where the risk is high. Controllers and processors designated as of major importance must register with the Commission and appoint a data protection officer. Transfers outside Nigeria need an adequate level of protection or another basis the Act allows.
The system view is in the Nigeria Data Protection Act and AI agents. Here the focus is what staff must know.
Who does it apply to?
Controllers and processors in Nigeria, and those outside Nigeria processing personal data of people in Nigeria. Sector regulators add their own layer: the Central Bank of Nigeria for banks, microfinance banks, payment service providers and other financial institutions; SEC Nigeria for capital markets operators; and NAICOM for insurers. Each expects regulated firms to protect customer data and remain responsible for technology they use.
Staff in scope include contact centre and service staff supervising agents, credit and collections teams, onboarding and KYC analysts, payments operations staff, data and IT teams setting agent sources, and the data protection officer. The DPO's role is covered in what a data protection officer is, and the DPO's own learning needs in what a data protection officer needs to know about AI agents.
What competence does the Act imply when agents act?
Identity data. Nigerian onboarding relies on bank verification numbers, national identity numbers and biometric checks. Biometric data is sensitive. Staff must know which agents may read identity data, for what purpose, and that an agent's onboarding summary should not repeat identifiers it does not need.
Automated decisions. A lending agent that declines an application, cuts a limit or reports a borrower to a credit bureau may be making a decision the right covers. Hold such decisions for a named person, or ensure people can obtain review. The reviewer must have authority to change the outcome and must look beyond the agent's summary.
Collections conduct. Agents that contact borrowers must never reach the borrower's phone contacts or disclose the debt to anyone else. Bound collections agents so such messages are refused, and train staff to recognise a draft that crosses the line.
Evidence quality. Records from the core banking system are sealed. A customer's statement of income is declared. A bank statement sent by email or a screenshot on a messaging app is external and must be checked before it drives a decision.
Breach recognition. An agent that sends a statement to the wrong person, or exposes another customer's details, has likely caused a notifiable breach. Staff must escalate at once so the controller can notify in time.
Cross-border processing. Many model providers process data abroad. Staff configuring agents must know where data goes and on what basis.
Depth gives each role a clear line. Agents read at depth 1, draft at depth 2, act on routine work at depth 3, and anything that moves money is depth 4 and held for a named person.
How do you meet the Act and show it?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Lawful basis and purpose | Agent sources mapped to purposes and bases | Processing register |
| Minimisation of identity data | Agents limited to the identifiers their task needs | Source lists; access reviews |
| Right on automated decisions | Significant agent decisions held or reviewed by trained staff | Hold and review records |
| Impact assessment | DPIA before agents profile or decide | Approved DPIA |
| Breach notification | Staff trained to recognise agent-caused breaches | Training records; incident log |
| Registration and DPO | Registration current where required; DPO involved | Registration records; DPO sign-offs |
| Cross-border transfers | Transfer basis recorded per agent | Transfer register |
| Record | Every agent verdict filed with sources used | Append-only decision record |
Whether agents need an impact assessment is covered in do AI agents need a data protection impact assessment. For agents that decide or profile, the answer is usually yes.
What will the NDPC or an auditor ask?
- What personal data does each agent use, and on what basis?
- Which agent decisions significantly affect people, and who reviews them?
- Show us the DPIA for this agent.
- How are identity and biometric data protected?
- How would staff recognise a breach caused by an agent?
- What training have supervisors and the DPO received?
What does the Act not cover?
It does not set prudential or conduct rules for financial firms; the CBN, SEC Nigeria and NAICOM do. It does not regulate AI as a technology. It does not prescribe training content. And it does not override legal duties such as anti-money laundering reporting. Kenya's regime is similar in shape; compare the Kenya Data Protection Act and staff training. The guide to AI literacy and certification covers the wider model.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
Pryme Intelligence Academy sets module tests in the learner's own industry and role, so a Lagos collections team is tested on collections cases. The Operator track teaches human review and when something goes wrong; certificates are issued through VerifyDoc.ai and can be checked by number or QR code. A firm can adopt a practice of letting only staff with a current certificate release held credit and collections decisions.
Questions people ask
Does the Act give a right against automated decisions?
Yes, in substance. People have a right not to be subject to solely automated decisions with legal or similarly significant effects, subject to exceptions and safeguards.
Can an agent read bank verification numbers?
Only if its task needs them. Limit identity data to the agents that must verify customers.
Who should own agent training under the Act?
The data protection officer should set the standard with the teams running agents. Accountability sits with the controller's management.