NDPA 2023: what Nigerian businesses using AI and automation should know

When you automate customer conversations, store leads in a CRM or pass messages through an AI model, you are processing personal data. In Nigeria that brings you under the Nigeria Data Protection Act 2023 (NDPA), which is enforced by the Nigeria Data Protection Commission (NDPC). The NDPC has also issued detailed guidance on how to apply the Act, so check the latest version when you set up a new system.

The core ideas in the Act

• Have a lawful basis for each use of personal data, such as consent, a contract, a legal obligation or a legitimate interest.
• Use data only for the purpose you collected it for, and collect no more than you need.
• Keep data accurate, keep it only as long as necessary, and keep it secure.
• Be able to show how you comply. Accountability is part of the law, not an extra.

Your customers' rights

People can ask what data you hold about them, ask you to correct or delete it, object to some uses, withdraw consent and, in some cases, ask for their data in a portable format. You need a simple way to receive and answer these requests, such as a dedicated email address.

Controllers, processors and your suppliers

If you decide why and how customer data is used, you are the data controller. Suppliers who handle data for you, such as a CRM, a WhatsApp provider or a developer running your automations, are processors. You should have a written agreement with each processor that covers security, confidentiality and what happens to the data when the work ends.

Breaches and transfers abroad

If a personal data breach is likely to put people at risk, the Act expects you to notify the NDPC promptly, within 72 hours of becoming aware of it, and in serious cases to tell the people affected. Many AI and cloud tools store data outside Nigeria. Transfers abroad are allowed, but only with the safeguards the Act requires, so know where each tool keeps your data.

A practical checklist for AI and automation

• List every tool that touches customer data, what data it holds and where it is stored.
• Send AI models only the data a task needs. Strip names and numbers where you can.
• Get clear opt-in before marketing broadcasts, and make opting out easy.
• Keep a human in the loop for decisions that significantly affect people.
• Set retention periods and actually delete old data.
• Use two-factor authentication and limit who can export data.
• Publish a privacy policy that matches what you really do.

Some larger organisations have extra duties, such as registering with the NDPC or appointing a data protection officer. Check whether your organisation is in scope as it grows.