Deploying AI in Nigeria under the NDPA and the GAID 2025

Nigeria regulates AI that touches personal data through the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Commission’s General Application and Implementation Directive (GAID) 2025. There is no AI-specific law in force. A National Digital Economy and E-Governance Bill and several AI bills have been before the National Assembly, but none had become law by October 2026, so the data protection rules carry the weight. This guide sets out the work in the order an organisation usually does it.

Find the AI that uses personal data

Everything in the GAID starts from knowing which systems process personal data and what they decide. That covers models you build, AI features inside software you already use, and generative AI tools staff use on their own. For each one, record the purpose, the personal data it uses, where that data comes from, who it affects, whether it produces decisions about people and how much a person is involved before a decision takes effect.

Note in particular where a system profiles people or makes decisions with legal or similar significant effects, such as credit, insurance, hiring, access to services or fraud flags. Those are the systems that trigger section 37 of the Act and a mandatory DPIA under Article 28 of the GAID. The AI system register guide covers what each entry should hold.

Decide which systems need a DPIA

Article 28(3) of the GAID lists the circumstances in which a DPIA is mandatory and must be filed with the Commission. For AI, the relevant items are profiling, automated decision-making with legal or similar significant effects, systematic monitoring, sensitive or highly personal data, vulnerable data subjects and innovative technologies that may pose a significant privacy risk. The list also names whole sectors, including financial services that process personal data through digital devices, health care, e-commerce, education and hospitality, and any cross-border data transfer.

The content of a DPIA comes from section 28(4) of the Act. It needs a systematic description of the processing and its purpose, an assessment of necessity and proportionality, an assessment of the risks to data subjects, and the measures to address them. For an AI system that means describing the model’s inputs and outputs, the decisions it feeds, the groups it affects and what could go wrong for them. A DPIA must be vetted by a certified DPO accredited by the Commission and carried out before processing starts. The AI impact assessment guide sets out a structure that covers these elements.

Work through Article 43 before deployment

Article 43 adds steps specific to AI and other emerging technologies. Before deploying, an organisation should

• set out and document technical and organisational parameters that keep the system within what the law permits, taking into account the right not to be subject to solely automated decisions, the right to be forgotten, sensitive data, children and vulnerable groups, cross-border data flows, and privacy by design and by default;
• carry out a DPIA that assesses disparate outcomes and uses the Data Subjects’ Vulnerability Indexes in Schedule 6 of the GAID;
• consider anonymising data on collection and testing the system in a low-risk environment where its effects can be observed;
• check whether outcomes differ across groups, and retest until they are satisfactory, or discard the tool if the privacy risk cannot be mitigated.

The disparate outcome check is a bias assessment by another name. The bias assessment guide covers how to choose the groups, measures and thresholds to test against.

Build the safeguards for automated decisions

Section 37(3) of the Act requires a controller to implement suitable measures, including the rights to obtain human intervention, to express a point of view and to contest the decision. Those rights apply whichever exception the controller relies on, so each system that decides on its own needs a working route to a person who can review and change the outcome. Section 27(1)(g) also requires the privacy notice to tell people about automated decision-making, its significance and envisaged consequences, and their right to object and challenge it.

For each system, write down who reviews contested decisions, what information they see, how quickly they respond and what authority they have. The human oversight guide covers how to make review meaningful rather than a rubber stamp.

Monitor once it is live

Article 43(4)(e) says that once a technology is judged safe for use, the controller must put in place a mechanism for continuous monitoring and evaluation wherever it is deployed. For AI, that means watching accuracy, outcomes across groups and drift over time, and knowing when a change is big enough to go back to the DPIA. Section 40 of the Act requires the NDPC to be notified within 72 hours of a breach likely to result in a risk to individuals, so incidents involving an AI system need a route into the breach process. The drift monitoring guide covers what to measure.

How Aicura supports the work

Aicura is an AI governance platform. Discovery and the AI register build the inventory, assessments record the purpose, affected people, risks and mitigations an impact assessment needs, oversight records who reviews which decisions, and monitoring watches each system once it is live. Vendor due diligence covers the AI suppliers that process data for you. Aicura does not assess against the NDPA or the GAID. It gives you the documented record that a DPIA, the Article 43 parameters and the compliance audit return depend on, and the decisions stay with you.

Aicura is hosted on AWS in Sydney, Australia, so using it involves transferring personal data out of Nigeria. Part VIII of the Act governs those transfers. Our data processing agreement sets out the safeguards that cover them.

A note on this page

This is Aicura’s reading of the Nigeria Data Protection Act 2023 and the GAID 2025. It is not legal advice. Read the Act and the GAID as published, and take advice on how they apply to your organisation.