The short answer
There is no AI-specific law in force in Nigeria. The National Digital Economy and E-Governance Bill, which includes provisions on AI, is still before the National Assembly, and the National Artificial Intelligence Strategy published in September 2025 is policy, not law.
But if an AI tool uses personal data, the Nigeria Data Protection Act 2023 (NDPA) applies in full, and the Nigeria Data Protection Commission's General Application and Implementation Directive (GAID) 2025, effective since September 2025, addresses AI and emerging technologies by name. In practice that means: protect people's right not to be subject to solely automated decisions, carry out a data privacy impact assessment (DPIA) where the GAID requires one, have a lawful basis for sending data to AI services abroad, and record your safeguards in your compliance returns.
This article is general information, not legal advice. Your data protection officer and legal advisers should confirm how the rules apply to you.
What the NDPA already requires for AI
- Automated decisions. People have the right not to be subject to a decision based solely on automated processing, including profiling, that has legal or similarly significant effects on them. Where an exception applies (a contract, consent or a law with safeguards), you must still offer human intervention, a chance for the person to give their view and a way to contest the decision. Your privacy notice must also say when you use automated decision-making.
- Impact assessments. A DPIA is required before processing that is likely to result in high risk to people, and the NDPC must be consulted if high risk remains after mitigation.
- Transfers outside Nigeria. Personal data may leave Nigeria only where the recipient is bound by adequate protection, such as contractual clauses or binding corporate rules, or where a ground such as informed consent applies, and you must record the basis for each transfer.
- Registration and accountability. Data controllers and processors of major importance must register with the NDPC, and general duties of lawful basis, purpose limitation, data minimisation, accuracy and security apply to AI like any other processing.
What the GAID 2025 adds
The GAID explains how the NDPA applies in practice and mentions AI explicitly:
- Document your safeguards. Organisations deploying AI or other emerging technologies must document the technical and organisational measures that protect data subjects, including their rights around automated decisions, sensitive data, children and vulnerable groups, and cross-border flows, and include them in the annual compliance audit return.
- Mandatory DPIAs. A DPIA is mandatory for, among other things, profiling and automated decisions with significant effects, systematic monitoring, sensitive data, new technologies, sectors such as digital financial services, health and education, and cross-border transfers.
- Test before you trust. AI tools should be tested in low-risk settings, monitored continuously, and retested or retired when they do not meet the standard.
The NDPC has also said it plans to review the NDPA to address AI and other emerging technologies. No draft had been published when we wrote this, so watch for updates.
Rather talk it through? If you are not sure whether your AI tools need a DPIA or a transfer safeguard, we can map them and prepare what is needed. Talk to a Promatics specialist
Why data location matters for AI in Nigeria
There is no major public cloud region in Nigeria. The nearest Microsoft Azure and Google Cloud regions are in South Africa, and Amazon Web Services offers a Lagos Local Zone whose parent region is in Cape Town. Most generative AI services process prompts outside Nigeria, and Microsoft 365 does not offer Nigerian data residency. So for most AI tools that touch personal data, you need a lawful transfer basis under the NDPA and, under the GAID, usually a DPIA.
From 1 January 2027, NITDA's National Cloud Technical Guideline sets data-residency rules for federal public institutions and regulated-sector organisations based on how sensitive the data is, and expects AI providers serving them to have AI governance, risk management and auditability, aligned with ISO/IEC 42001. Sector regulators such as the CBN, SEC Nigeria and the NCC may add their own expectations.
Self-hosting is the way to keep AI processing in Nigeria. An open-weight model running on servers on your premises or in a Nigerian data centre processes prompts and documents locally, so they do not have to cross borders at all; the NDPA and the GAID still apply to the personal data it handles. See private AI and self-hosted models.
What to do now
- List the AI tools and features in use, including ones staff use without approval (shadow AI).
- For each, record what personal data goes in, where it is processed and whether the vendor uses it for training.
- Stop personal, confidential and classified information going into public AI tools; approve suitable business tools instead.
- For information too sensitive for any outside AI provider, consider models hosted on servers you control, on your premises or in a Nigerian data centre.
- Identify decisions about people (credit, hiring, eligibility, pricing) where AI plays a part, and build in human review and a way to contest them.
- Carry out DPIAs where the GAID requires them, including for transfers abroad, and keep them on file.
- Put transfer safeguards in place with AI vendors and record the basis for each transfer.
- Update your privacy notice to describe any automated decision-making.
- Record your AI safeguards for your compliance audit return.
- Publish an AI acceptable use policy and train staff on it.
When to bring in help
A small organisation using one or two business AI tools for drafting can often manage with a clear policy, sensible settings and its data protection officer's guidance. Bring in help when AI touches decisions about people, when you process sensitive or financial data, when you are in a regulated sector, or when you are building AI into your own products and services.
Our AI governance and security service inventories your AI use, prepares the assessments and safeguards the NDPA and GAID expect, applies technical controls and documents everything in plain language. We work alongside your data protection officer and legal advisers, who remain responsible for legal interpretation. If you are just getting started, an AI readiness assessment covers governance as part of a broader plan.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Nigeria Data Protection Act 2023, Nigeria Data Protection Commission
- General Application and Implementation Directive (GAID) 2025, Nigeria Data Protection Commission
- National Cloud Technical Guideline 2026, National Information Technology Development Agency
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.