Day after day, an increasing number of businesses are incorporating Artificial Intelligence (AI) tools and systems into their operations to process customers’ personal data, analyse information, and automate decision-making processes. The reason for this growing adoption is not difficult to appreciate, as AI tools/AI systems are capable of processing, analysing, and extracting insights from vast and complex datasets with precision, consistency, and objectivity in seconds, far beyond human capabilities if replicated within the same timeframe. By properly integrating the right AI tool into everyday workflows, businesses no longer have to serve clients by guesswork but can confidently rely on real-time intelligence that is precise and reliable, even as they offer tailored solutions or products to their clients.
However, as it has been proven time and again, the benefits associated with technological advancement invariably come with corresponding risks. AI systems are fundamentally data-dependent and in many instances require access to a substantial volume of data to train, refine, and optimize their performance. This creates data protection concerns, particularly where personal data is collected or processed without a lawful basis or in circumstances where data subjects are not properly informed about how their information will be used.
These concerns become even more significant where AI systems are deployed to make or substantially influence decisions affecting individuals. AI systems are not inherently immune from the biases and prejudices present in the data used to train them. Where training datasets contain historical, social or human biases, those biases may be replicated or amplified by AI systems, potentially resulting in decisions that are discriminatory, inaccurate, opaque or otherwise unfair. The consequences may include unjustified profiling, discriminatory outcomes, privacy violations, unauthorised disclosure or leakage of personal data, and the inappropriate deployment or repurposing of individuals’ personal information.
It is against this backdrop that the Nigeria Data Protection Act1 2023 and its General Application and Implementation Directive 20252 are essential, as they include provisions that act as guardrails to protect data subjects in Nigeria from misuse of their personal data and hold AI developers and businesses that use AI tools responsible, with a view to ensuring that the pursuit of innovation and operational efficiency does not come at the expense of the rights and freedoms of data subjects in Nigeria.
MY BUSINESS USES AI – DOES THE NDPA AND/OR THE GAID APPLY TO ME?
Perhaps, one way to begin this write-up is by explaining that it is not every business that uses AI that automatically comes under the radar of the NDPC3.
The NDPA and GAID regulate the protection of personal data and the privacy rights4 of data subjects in Nigeria. They establish the legal basis for the lawful collection, processing, storage, use and disclosure of personal data, while imposing obligations on organisations that process such data. Together, they strengthen Nigeria’s data protection framework by promoting lawful, fair and transparent processing of personal data and enhancing accountability among data controllers and processors.
Before the GAID was enacted, the NDPA was established in 2023 to provide a legal framework for the protection of personal information and establish the Nigeria Data Protection Commission for the regulation of the processing of personal information, among other things. The GAID was later enacted in 2025 to operationalize the implementation of the NDPA and provide legal certainty and specific rules to protect privacy in a world of “disruptive technologies and shifting paradigms of engagements”5.
As such, any organisation using AI that will fall under the radar of the NDPC or its GAID must be a business deploying AI in the collecting, handling, processing, and storing of personal data of Nigerians.
WHAT IS AI PROFILING AND AUTOMATED DECISION-MAKING, AND WHEN DOES THE GAID APPLY?
Profiling is the act of collecting information about a person or thing to build a summary of their traits, habits, and/or behaviours.
According to the Euro-Atlantic Resilience Journal6, “AI profiling uses algorithms and automated systems to collect and analyse large volumes of data, including online interactions, to create detailed profiles of individuals or groups.”
Automated decision-making, on the other hand, refers to the making of a decision about someone based on collected data, without any form of human intervention or oversight. Under the NDPA, automated decision-making is defined as a decision based solely on automated processing by automated means, without any human involvement.7 In other words, it is a process whereby a choice or decision about someone is solely made by machines, algorithms, or AI based on data collected about the person.
WHEN DO THE NDPA AND ITS GAID APPLY?
The advent of emerging technologies like AI and its ability to collect, store, process, continuously learn, and generate predictions from people’s data has brought about more issues that extend beyond conventional data processing, such that there has arisen a need for legal regulations to “address not only data collection but also algorithmic accountability, explainability, fairness testing, and human oversight8” during data processing activities.
As such, when it comes to deploying emerging technologies like AI for the processing of personal data and making automated decisions regarding data subjects in Nigeria, the NDPA and its GAID, which are primary regulations for data privacy in Nigeria, contain provisions that place clear obligations on data controllers and data processors9 to implement appropriate safeguards that protect the rights and interests of data subjects. Some of these obligations include, but are not limited to:
A. carrying out a Data Protection Impact Assessment (DPIA),
A. Implementing suitable measures to safeguard the fundamental rights, freedoms, and interests of data subjects,
B. setting forth technical and organizational measures in place before using the emerging technology for data processing activities, etc.
It is imperative to state that any business desirous of deploying emerging technologies in its processing must take into account the provisions of the NDPA, public policy as well as the GAID and other regulatory instruments as may be issued by the NDPC in order to safeguard the privacy of data subjects.10
WHEN IS A DPIA11 MANDATED FOR AI, AND WHAT SHOULD IT COVER?
With respect to carrying out a DPIA, Section 28 of the NDPA provides that a data controller shall carry out a DPIA before processing the personal data of a data subject, where the processing of personal data may likely result in high risks to the rights and freedoms of a data subject by virtue of its nature, scope, context, and purposes.
Article 28 of the GAID further provides that a DPIA is required in the following circumstances:
i. Introduction of new technologies or new processing techniques or directives mandating processing of personal data on a large scale12
ii. Automated decision-making with legal or similar significant effects
iii. Evaluation or scoring (profiling)
iv. When considering the deployment of innovative processes or applications, of new technological or organisational solutions which may pose a significant risk to the privacy of data subjects;
By Article 43 of the GAID, a data controller or data processor who deploys or intends to deploy emerging technologies like AI, etc., shall carry out a DPIA taking into account several factors such as the actual performance and effects of the said technology and the vulnerability of the data subjects affected by the use of such technology for the data processing activity13.
With it being clear the instances where a DPIA is mandated, it is equally essential to set out the contents a DPIA is required to cover. The NDPA sets out the core elements that should be included in a DPIA, while the GAID provides for additional content a DPIA shall comprise, and these include:
i. An overview of the processing activity: states the purpose of the processing activity, the personal data involved, how it will be collected, and the processing activity14
ii. An assessment of whether the processing is necessary for the stated purpose and the amount and type of data required, and the manner of processing15
iii. Assessment of the risks the proposed processing could pose to the rights and freedoms of a data subject16
iv. What measures can be used to mitigate those risks and what mechanisms can be put in place to ensure the protection of personal data of the data subjects17
v. Assessment of the outcome or effect of AI profiling and/or automated decision-making and the vulnerability of data subjects affected by the outcome18
vi. Contain measures which show that privacy protection has been considered and built into the technology system (privacy by design and privacy by default)19
vii. Assessment of the security measures needed to ensure full protection at all times20
It is worth noting that, under the provisions of the GAID, where a DPIA is required, it should be carried out before the commencement of the data processing activity and submitted to the NDPC, after being signed by a duly certified DPO accredited by the NDPC21.
WHAT ARE MY RIGHTS WHEN AI MAKES A DECISION ABOUT ME?
Aside from the general rights that you may have as a data subject, some extra rights would accrue when a technological tool is used to make an automated decision that affects you, like denying you a loan, rejecting your job application, implicating you, or maybe something more serious. The NDPA provides that you have the right not to be subject to an automated decision based solely on automated processing of your personal data22. By the provisions of Section 37(3) of the NDPA, a data controller shall implement certain safeguards to protect the data subjects’ rights and freedoms, which include:
i. The right to human intervention/oversight
ii. The right to express their point of view
iii. The right to contest the decision
It is worth noting that the NDPA recognises certain instances when automated decision-making may be allowed, such as23:
i. where that automated decision is necessary for entering into or performing any contract;
ii. where it is authorised by a written law which establishes measures to safeguard your fundamental rights and interests; and
iii. where you have authorised such automated decision-making.
Notwithstanding these exceptions, a data controller and data processor are not relieved of their responsibility to safeguard the rights of affected data subjects.
CONCLUSION
One common misconception many people have is that the AI landscape is an area that remains largely unregulated in Nigeria. However, while Nigeria may still lack a single all-encompassing AI regulation, it would be an error and a big legal risk for business owners to assume that this absence of a body of AI regulation equals a lack of oversight by Nigerian regulators over the way and manner AI systems and tools are used.
As a country, Nigeria today uses a combination of laws to regulate the use of AI, and due to the heavy reliance of AI on data to function optimally, frameworks like the NDPA and the GAID come to the forefront. These regulations heavily regulate the collection, processing, analysing, and storing of personal data of Nigerians, and businesses involved in such activities are required to not only respect the rights of the data owners as spelt out in the regulations but also to carry out stated obligations if they are to remain NDPC-compliant.
Footnotes
1. NDPA
2. GAID
3. The NDPC stands for Nigeria Data Protection Commission, and it is the body responsible for administering the NDPA and the GAID. The NDPC is also the regulator of privacy and data protection in Nigeria.
4. Section 37 of the 1999 Constitution of the Federal Republic of Nigeria
5. See the preamble of the GAID 2025.
6. Euro-Atlantic Resilience Journal, ISSN: 2972-1903 ISSN-L: 2972-158X, Vol. 3, Issue 5/2025.
7. Section 65, NDPA
8. International Journal of Humanities, Social Sciences and Education (IJHSSE) – Artificial Intelligence and Automated Decision-Making under the Nigeria Data Protection Act 2023: Evaluating the Adequacy of Nigeria’s Data Protection Framework
9. See Section 37 of the NDPA and Article 43 of the GAID
10. See Article 4391) of the GAID
11. Data Processing Impact Assessment
12. See Article 28 (2),(3 a-b) of the GAID
13. Article 43 (4) of the GAID
14. Section 28 (4) (a)
15. Section 28 (4) (b)
16. Section 28 (4) (c)
17. Section 28 (4) (d)
18. Article 43 (4) (a) of the GAID
19. Article 28 (11) of the GAID
20. Article 28 (11) of the GAID
21. Article 28 (9) (12) of the GAID
22. Section 37 (1) of the NDPA
23. Section 37 (2) of the NDPA
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
