What Nigeria's Data Regulator Now Expects From Your AI

In October the Nigeria Data Protection Commission made the same point twice, in two different rooms.

At a stakeholders' consultation on frontier AI, hosted by NITHUB, the University of Lagos and the Tech Governance Project, the Commission called for stronger data governance, algorithmic transparency and privacy by design in how AI is built and regulated. Its representative proposed building ISO/IEC 42001:2023, the international standard for AI management systems, into Nigeria's planned AI regulatory sandbox. [The NDPC's own account of the consultation is here](https://ndpc.gov.ng/governing-frontier-ai-ndpc-mandates-algorithmic-transparency-and-privacy-by-design-at-nithub-consultation/).

Then on 28 October the National Commissioner, Dr Vincent Olatunji, gave the first keynote at NITDA's International Cybersecurity Conference 2026, on trust by design in the age of AI. His message, as [Tech Review Africa reported it](https://techreviewafrica.com/news/8001/nigeria-data-protection-commissioner-calls-for-privacy-and-cybersecurity-in-ai-development), was that data protection, privacy, cybersecurity and accountability have to be built into every stage of AI development and deployment.

Last month I wrote about [NITDA's advisory on public AI tools](/blog/nitda-public-ai-tools-sensitive-data-ai-governance), which told staff what to keep out of a chatbot. The NDPC is now speaking to the other end of the problem: how any AI system that touches personal data should be designed in the first place.

## "We are not building frontier models"

Most Nigerian companies are not, and the consultation was about frontier AI. That does not let anyone off, because the rules that apply to a bank's credit model or a retailer's chatbot are already in force.

Nigeria has no AI-specific law yet. [Dentons ACAS-Law's review in September](https://www.dentonsacaslaw.com/en/insights/articles/2026/september/8/navigating-ai-governance-in-nigeria) describes the framework as policy-led. But the Nigeria Data Protection Act 2023 covers the processing of personal data, and an AI system that uses personal data is processing it. Section 28 of the Act requires a data privacy impact assessment where processing is likely to result in a high risk to people's rights and freedoms. If the assessment still shows high risk after the safeguards you plan, you must consult the Commission before you go ahead.

The [General Application and Implementation Directive](https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf) that the NDPC issued in March 2025, known as the GAID, deals with emerging technologies directly. Its Article 43 covers organisations that use AI, the Internet of Things or blockchain on personal data, and asks them to put privacy by design and by default first. [Law firm summaries of the GAID](https://www.mondaq.com/nigeria/privacy-protection/1700306/gaid-2025-unpacked-series-ii-data-protection-officers-mandatory-consents-and-emerging-technologies) add that the design should take account of people's rights around automated decisions.

So privacy by design is already in the rules. What changed in October is how plainly the Commission is now saying it about AI.

## What privacy by design looks like on a real AI project

Strip out the jargon and it means settling the data questions before the system is built, rather than after a complaint. On a real project that comes down to six things.

1. **Know what you are running.** List every AI tool in use, including the free ones staff use on their own. You cannot protect data in a system you do not know exists. This is BROAI again, Bring Your Own AI. 2. **Ask whether the AI needs personal data at all.** Often it does not. A tool that drafts customer replies does not need the customer's BVN. Remove or mask whatever the task does not need. 3. **Assess anything that judges people before it goes live.** Credit scoring, CV screening, fraud flags and churn models that change what a customer is offered all make decisions about people. They are the obvious candidates for a data privacy impact assessment. 4. **Read the vendor's data terms.** Where is the data stored, does it leave Nigeria, and are your inputs used to train someone else's model? The answers belong in the contract, in writing. 5. **Be able to explain a decision.** If a customer asks why the system turned them down, someone in your company should be able to answer in plain words. That is what algorithmic transparency means in a branch or a call centre. 6. **Name an owner.** One person accountable for each system, with a record of what it does, what data it uses and when it was last checked.

None of this needs a certificate. ISO/IEC 42001 and the NIST AI Risk Management Framework, which I follow in my own governance work, both give you a structure to borrow. Start with the structure. Certification can come later, if a client or a regulator asks for it.

## Why boards should move now

The direction is clear from what the Commission said in October: standards, sandboxes and accountability at every stage. Companies that build these habits into AI projects now will find the next rules easy to meet. Companies that add them after an incident will pay more for the same work, and they will be doing it in public.

Governance also lets you say yes to AI faster. When people know which tools are approved and what data can go where, projects stop stalling in legal review.

How many AI tools are running in your organisation today, and could you name the owner of each one?

If you want help putting this in place, my [AI governance](/ai-governance) page sets out how I work, and [the SWITCH Method](/switch-method) starts with exactly this inventory. You can also [work with me](/work-with-me) directly, or book a session for your leadership team through [speaking and training](/speaking).

This post is my reading of public statements and of the rules, not legal advice. Check the Act and the GAID themselves, or ask a data protection lawyer, before you rely on it for a specific system.

## Frequently asked questions

**Does the Nigeria Data Protection Act apply to AI?** Yes, wherever an AI system processes personal data. Nigeria has no AI-specific law yet, so the Act and the NDPC's General Application and Implementation Directive are the rules that apply.

**What does privacy by design mean for an AI project?** Deciding what personal data the system needs, how it will be protected and who is accountable before it is built, rather than fixing problems after launch.

**Does every AI tool need a data privacy impact assessment?** No. Section 28 of the Act requires one where processing is likely to result in a high risk to people's rights and freedoms. Systems that score, screen or make decisions about people are the first to check.

**What is ISO/IEC 42001?** An international standard, published in 2023, for running an AI management system. The NDPC has proposed building it into Nigeria's planned AI regulatory sandbox.

*Stanislaus Martins advises and trains organisations across Sub-Saharan Africa on practical AI adoption and governance. AI Governance, Saïd Business School, University of Oxford.*