Nigeria Data Protection Act 2023 and automated decision-making

What it is

The Nigeria Data Protection Act 2023, known as the NDPA, is Nigeria’s general data protection law. It commenced on 12 June 2023 and was published in the Official Gazette as Act No. 37 of 2023. It established the Nigeria Data Protection Commission (NDPC) as the regulator.

Section 37 is the Act’s rule on automated decision-making. It sits in Part VI, which sets out the rights of data subjects, and it is the main binding rule in Nigerian law aimed at decisions made by algorithms, including AI systems, about people. The Act defines automated decision-making as a decision based solely on automated processing by automated means, without any human involvement.

Who it applies to

Section 2 applies the Act to the processing of personal data, whether by automated means or not, where the data controller or processor is domiciled in, resident in or operating in Nigeria, where processing occurs within Nigeria, or where a controller or processor outside Nigeria is processing personal data of a data subject in Nigeria.

The duty under section 37 sits with the data controller, the body that determines the purposes and means of processing. An organisation that uses a vendor’s AI system to score credit, screen applicants or flag fraud is still the controller for those decisions. The vendor is usually a data processor acting on its behalf, and section 29 requires the controller to make sure the processor meets the Act’s standards.

What it requires

Section 37(1) gives a data subject the right not to be subject to a decision based solely on automated processing of personal data, including profiling, which produces legal or similar significant effects concerning them.

Section 37(2) sets out three exceptions. The right does not apply where the decision is

• necessary for a contract, meaning for entering into or performing a contract between the data subject and the controller;
• authorised by a written law that establishes suitable measures to safeguard the data subject’s fundamental rights, freedoms and interests; or
• authorised by the data subject’s consent.

Section 37(3) then requires the controller to implement suitable measures to safeguard the data subject’s fundamental rights, freedoms and interests, including the rights to obtain human intervention on the part of the controller, to express their point of view and to contest the decision. Unlike some other laws, these safeguards are not limited to the contract route.

Other parts of the Act apply alongside section 37.

• Notice. Section 27(1)(g) requires a controller, before collecting personal data, to tell the data subject about the existence of automated decision-making, including profiling, its significance and envisaged consequences, and the right to object to and challenge it.
• Access. Section 34 lets a data subject ask whether their data is being processed and, where it is, to be told about any automated decision-making, including profiling, and its significance and envisaged consequences.
• Impact assessment. Section 28 requires a data privacy impact assessment before processing that is likely to result in high risk to the rights and freedoms of a data subject, and consultation with the NDPC if the assessment shows high risk remains.
• Breach notification. Section 40 requires a controller to notify the NDPC within 72 hours of becoming aware of a breach likely to result in a risk to the rights and freedoms of individuals, and to tell data subjects immediately where the risk is high.

For an AI system, that turns into four practical questions. Which systems make decisions about people with legal or similarly significant effects, and is a person genuinely involved before the decision takes effect? Where a system decides on its own, which exception applies? Can the organisation tell people about the automated decision and its consequences in its notice? And is there a working route for a person to reach a human, put their view and contest the outcome?

Penalties

Under section 48, the NDPC can order a controller or processor in breach to pay a penalty or remedial fee. For a data controller or processor of major importance the cap is the greater of ₦10,000,000 and 2% of annual gross revenue in the preceding financial year. For others it is the greater of ₦2,000,000 and 2% of annual gross revenue. Section 51 also lets a data subject who suffers injury, loss or harm recover damages in civil proceedings.

Key dates

• 12 June 2023. The NDPA commences.
• 1 July 2023. The Act is published in the Official Gazette as Act No. 37 of 2023.
• 20 March 2025. The NDPC issues the General Application and Implementation Directive (GAID) 2025, which sets out how the Act applies in practice.
• 19 September 2025. The GAID takes effect.

How it relates to other frameworks

Section 37 follows GDPR Article 22 closely. Both target decisions based solely on automated processing with legal or similarly significant effects, both allow them for contracts, under law and with consent, and both rest on human intervention and the ability to contest the outcome. South Africa’s POPIA section 71 has a narrower set of exceptions and no consent route.

The NDPC’s GAID 2025 adds detail for AI. It makes a data privacy impact assessment mandatory for automated decision-making with legal or similar significant effects, and Article 43 sets conditions for deploying AI and other emerging technologies on personal data. Organisations often structure that work on an international framework such as ISO/IEC 42001 or the NIST AI RMF.

A note on this page

This is Aicura’s reading of section 37 of the Nigeria Data Protection Act 2023. It is not legal advice and it is not the Act itself. Read the Act as published in the Official Gazette, and take advice on how it applies to your organisation.