Personal data, AI tools and transfers abroad
What Nigeria's data protection law expects before customer or staff data leaves the country, including through AI features, and the controls to use.
By Achekam · · 4 min read · For Running a business businesses in Nigeria
An AI assistant drafts a reply to a customer complaint in seconds. To do it, the customer's name, their order history and the text of their complaint travel to an AI model run by a company that may well sit outside Nigeria. Most business owners never think of that as a transfer of personal data abroad. Nigeria's data protection law does.
This article sets out what the Nigeria Data Protection Commission says about sending personal data out of Nigeria, how that applies when staff use AI features, and the controls Achekam gives a Nigerian business over which AI vendor is used, what is sent, and whether AI is used at all.
Does the Act reach your business?
The NDPC says the Nigeria Data Protection Act, 2023 applies to an organisation domiciled, resident or operating in Nigeria, to processing of personal data within Nigeria, and to an organisation outside Nigeria that processes personal data of a data subject in Nigeria.
For a Nigerian business with Nigerian customers and staff, the answer is almost always yes. The fuller test is in does the NDPA apply to your business.
The Act also places duties on both sides of an outsourced arrangement. The NDPC states that under section 29 a data controller, the organisation that decides the purpose and manner of processing, must ensure that the methods by which data is collected are strictly in line with the principles of data protection. A data processor must ensure that processing on behalf of the controller follows those principles. When you use a software service, you are usually the controller; the service and anyone it passes data to are processors.
Adequate protection before a transfer
The NDPC says a data controller or processor transferring personal data abroad must ensure an adequate level of protection, for example through an NDPC adequacy decision or a Cross Border Data Transfer Instrument approved by the Commission before the transfer takes place. Its FAQ cites sections 41 to 43 of the Act and also lists other lawful bases, such as consent and contract.
In practice, that gives you three questions to ask about any tool that sends data outside Nigeria:
- Is the destination covered by an adequacy decision?
- If not, is there an approved instrument in place before the transfer?
- If neither, does another lawful basis, such as the person's consent or a contract with them, genuinely apply?
The NDPC answers common questions on scope, transfers and the lawful bases on its frequently asked questions page.
Which AI vendors Achekam can route to, and whose key
Achekam's AI features go through one AI engine, which can use Anthropic, OpenAI, Google Gemini, DeepSeek or xAI. It uses the workspace's own API key first, and the platform's key only where that is allowed. Administrators manage this under Settings, in "AI models, keys, routing & spend". With no key at all, every AI feature says so and drafts nothing.
That set-up matters for a transfer assessment. If the business uses its own key with a vendor, the business has its own agreement with that vendor, and can read that vendor's terms on where and how it processes data. Write down which vendor and model your workspace uses, and keep the vendor's data-processing terms with your records.
What is removed before text is sent, and what is not
By default, Achekam's AI engine removes South African ID numbers from text before it is sent to an AI vendor. The removal can be switched off in AI settings.
Be clear about the limit for a Nigerian business: that removal covers South African ID numbers. It is not described as removing Nigerian NINs, BVNs or other identifiers. If staff paste a customer's NIN into a prompt, assume it goes to the vendor as typed. Train staff not to put identity numbers, bank details or health information into AI prompts at all unless your assessment allows it.
The engine also refuses any task whose type is giving an opinion, reaching a conclusion, approving or signing. AI drafts; a person decides what is sent or relied on.
Seeing what was sent, and switching AI off
The AI Activity Log lists every AI request, with the vendor, the model, the tokens used and an estimated cost from vendor list prices. A workspace administrator can switch AI off for the whole workspace.
Those two controls are the backbone of an honest position. The log tells you which vendors actually received requests and when. The switch lets you stop all AI use while you complete an assessment, or permanently if you decide the transfers cannot be justified.
Choosing where your files are kept
AI is not the only route abroad. Files your staff upload, such as contracts, ID copies and payslips, are stored somewhere too. A workspace administrator can point the workspace's file storage at the business's own S3-compatible bucket, SharePoint, OneDrive or Google Shared Drive, and copy existing files across. Choosing your own storage means choosing your own provider and its terms, which you can then assess like any other transfer.
A transfer register for your business
Keep a simple register, reviewed at least yearly:
| What data | Tool or provider | Leaves Nigeria? | Basis relied on | Evidence kept |
|---|---|---|---|---|
| Customer messages sent to AI drafting | The AI vendor in your workspace settings | Check the vendor's terms | Adequacy, instrument, consent or contract | Vendor terms, AI Activity Log extract |
| Uploaded documents | Your chosen file storage | Check the provider's terms | As above | Provider terms |
| Staff payroll data | Your payroll and e-mail providers | Check | As above | Provider terms |
Healthcare businesses face the hardest version of these questions; AI and patient ID numbers works through them. Start by opening the AI Activity Log and listing the vendors it shows.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
