Nigeria Data Protection Act 2023 and AI tools for SMEs
The Nigeria Data Protection Act, 2023 (Act No. 37, Official Gazette No. 119, 1 July 2023) sets the rules for processing personal data in Nigeria.
Who it covers (section 2)
The Act applies to processing of personal data "whether by automated means or not" (s2(1)) where the controller or processor is domiciled in, resident in or operating in Nigeria, where the processing happens in Nigeria, or where a controller outside Nigeria processes the personal data of a data subject in Nigeria (s2(2)).
Lawful basis (section 25)
Processing is lawful only on a listed basis: consent, or where it is necessary for a contract, a legal obligation, vital interests, a public-interest task, or legitimate interests (s25(1)). Legitimate interests do not count where they override the data subject's rights or where the person would not reasonably expect the processing (s25(2)).
Automated decisions (section 37)
"A data subject shall have the right not to be subject to a decision based solely on automated processing of personal data, including profiling, which produces legal or similar significant effects concerning the data subject." (s37(1))
Where an exception applies, the controller must put safeguards in place, including the rights to obtain human intervention, to express a point of view and to contest the decision (s37(3)).
Direct marketing (section 36)
A data subject has the right to object, at any time, to processing for direct marketing, including related profiling (s36(3)); after an objection the data must no longer be processed for that purpose (s36(4)).
A practical first step
List each AI system you use, what personal data it touches, the lawful basis you rely on, and whether it makes decisions on its own. That record helps with sections 25, 36 and 37.
Official source
Start free: EURO AI Register (1 AI system free; $19/month or $190/year). It is a record-keeping tool. It is not legal advice and not a certification.
Accountant or tax practitioner? See the partner programme.
General information, not legal advice. Checked against the official texts linked above on 14 October 2026; read the law itself or ask a qualified adviser before acting.