The short answer
There is no AI-specific law in force in Nigeria. The National Digital Economy and E-Governance Bill, which includes AI provisions, is still before the National Assembly, and the National Artificial Intelligence Strategy (September 2025) is policy, not law. But where an AI tool uses personal data, the Nigeria Data Protection Act 2023 (NDPA) applies in full, and the NDPC's GAID 2025, effective since September 2025, names AI directly.
What the NDPA already requires for AI
General information, not legal advice; your data protection officer and legal advisers should confirm how the rules apply to you.
| Rule | What it means for AI |
|---|---|
| Automated decisions | People have the right not to be subject to a decision based solely on automated processing, including profiling, with legal or similarly significant effects. Where an exception applies (a contract, consent or a law with safeguards), still offer human intervention, a chance to give their view and a way to contest. Your privacy notice must say when you use automated decision-making |
| Impact assessments | A data privacy impact assessment (DPIA) before processing likely to result in high risk; consult the NDPC if high risk remains after mitigation |
| Transfers outside Nigeria | Only where the recipient is bound by adequate protection (contractual clauses, binding corporate rules) or a ground such as informed consent applies; record the basis for each transfer |
| Registration and accountability | Data controllers and processors of major importance register with the NDPC; lawful basis, purpose limitation, data minimisation, accuracy and security apply to AI like any other processing |
What the GAID 2025 adds
The GAID explains the NDPA in practice and names AI:
| Requirement | Detail |
|---|---|
| Document your safeguards | Organisations deploying AI or other emerging technologies document the technical and organisational measures protecting data subjects (automated-decision rights, sensitive data, children and vulnerable groups, cross-border flows) and include them in the annual compliance audit return |
| Mandatory DPIAs | Among other things: profiling and automated decisions with significant effects, systematic monitoring, sensitive data, new technologies, sectors such as digital financial services, health and education, and cross-border transfers |
| Test before you trust | Test AI in low-risk settings, monitor it continuously, and retest or retire it when it falls short |
The NDPC plans to review the NDPA for AI and other emerging technologies; no draft had been published when we wrote this, so watch for updates.
Rather talk it through? If you are not sure whether your AI tools need a DPIA or a transfer safeguard, we can map them and prepare what is needed. Talk to a Promatics specialist
Why data location matters for AI in Nigeria
There is no major public cloud region in Nigeria: the nearest Microsoft Azure and Google Cloud regions are in South Africa, and Amazon Web Services' Lagos Local Zone has its parent region in Cape Town. Most generative AI services process prompts abroad and Microsoft 365 offers no Nigerian data residency, so most AI tools touching personal data need a lawful NDPA transfer basis and, under the GAID, usually a DPIA.
Self-hosting keeps AI processing in Nigeria: an open-weight model on your premises or in a Nigerian data centre handles prompts and documents locally, with no border crossing; the NDPA and GAID still apply to its personal data. See private AI and self-hosted models.
What to do now
- List AI tools in use, including unapproved ones (shadow AI).
- Record personal data in, processing location, vendor training use.
- Keep personal, confidential, classified data out of public AI; approve business tools.
- Too sensitive? Self-hosted models, on your premises or a Nigerian data centre.
- AI in credit, hiring, eligibility, pricing? Build in human review and contest routes.
- DPIAs done where the GAID requires them, transfers included, and filed.
- Transfer safeguards agreed with AI vendors; basis recorded for each transfer.
- Privacy notice describes any automated decision-making.
- AI safeguards recorded for your compliance audit return.
- Publish an AI acceptable use policy and train staff on it.
When to bring in help
One or two business AI tools for drafting: a clear policy, sensible settings and your data protection officer's guidance often suffice. Bring in help when AI touches decisions about people, sensitive or financial data, a regulated sector, or your own products and services.
Our AI governance and security service inventories your AI use, prepares the assessments and safeguards the NDPA and GAID expect, applies technical controls and documents it in plain language, alongside your data protection officer and legal advisers, who remain responsible for legal interpretation. Starting out? An AI readiness assessment covers governance within a broader plan.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Nigeria Data Protection Act 2023, Nigeria Data Protection Commission
- General Application and Implementation Directive (GAID) 2025, Nigeria Data Protection Commission
- National Cloud Technical Guideline 2026, National Information Technology Development Agency
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.