Governance and Policy ManagementNDPA 2026 Compliance in Nigeria: How GAID Applies to AI and Automated Decisions
Nigeria NDPA compliance changed materially after the Nigeria Data Protection Commission brought the NDP Act General Application and Implementation Directive 2025, or GAID, into force on 19 September 2025.
For organizations entering 2026 with privacy programmes built mainly around the Nigeria Data Protection Act 2023, the task is no longer limited to updating privacy notices or appointing a Data Protection Officer. GAID adds more operational detail around Compliance Audit Returns, Data Privacy Impact Assessments, cross-border transfers and emerging technologies such as artificial intelligence.
That matters because AI systems are increasingly processing customer records, employee information, financial data and other personal information that already falls under the NDPA. The technology may be new. The accountability obligations are not.
Nigeria has no standalone AI law, which means every AI tool processing personal data in the country is already regulated by the Nigeria Data Protection Act 2023 and its implementing directive. Complyan’s guide to NDPA 2023 compliance covers registration, governance, and the role of the regulator. This piece covers the part most organizations have not mapped yet: what the NDPA and the General Application and Implementation Directive (GAID) 2025 require when AI, scoring models, or automated decisions touch personal data.
What the Law Already Says About AI
As of May 2026, Nigeria has no comprehensive standalone AI Act. AI is regulated indirectly, mainly through the NDPA, because most AI systems process personal data. Section 37 gives individuals the right not to be subject to a decision based solely on automated processing where that decision has legal or similarly significant effects, along with rights to human intervention, to express a view, and to contest the decision.
GAID took effect on 19 September 2025, according to IOC Law’s 2026 compliance guide, so organizations are now expected to demonstrate implementation rather than future intent. The NDPC has also announced a review of the NDPA to address AI, robotics, and big data directly.
Where AI Triggers Specific Obligations
Automated decisions: a loan rejection, an account suspension, a hiring screen, or a fraud flag that no person meaningfully reviews falls under Section 37. The Act does not define “significant effect,” and Legal 500 notes that the NDPC has not yet issued guidance on it, so a conservative reading is the safer one.
Impact assessments before deployment: per TheNigeriaLawyer’s summary of GAID, a DPIA is mandatory for profiling, automated decision-making, and systematic monitoring, among other activities, and must be vetted by a certified DPO before processing begins. Legal 500 adds that organizations using emerging technologies, including AI, need a documented DPIA before deployment.
Explicit consent: the same GAID summary states that explicit consent is still required for automated decision-making, direct marketing, children’s data, and cross-border transfers, even though implied consent is accepted elsewhere.
Cross-border transfers: an AI service hosted outside Nigeria is a transfer. IOC Law points to Sections 41 to 43 of the Act and GAID, and notes that remote access alone can create a transfer, so a team overseas querying a Nigerian customer database counts.
Vendor and processor roles: an AI provider may be a processor for hosted data and an independent controller for its own logs or billing records. IOC Law stresses that roles are decided by facts, not contract labels, which means each AI integration needs its own assessment.
What a Defensible DPIA Covers for an AI System
IOC Law’s guide describes the core contents of a DPIA: the proposal itself, necessity and proportionality, risks to individuals, mitigations, residual risk, and a named decision owner. For an AI system, that translates into specific questions:
Data in: which personal data feeds the model, from which systems, and whether any of it is sensitive or relates to children.
Decision out: which outcomes affect a person’s access to credit, employment, services, or an account, and who can override them.
Change triggers: IOC Law recommends revisiting a DPIA when the product, dataset, recipient, or technology changes, and an AI model update or a switch to a new vendor meets that test.
AI Has Now Been Explicitly Brought Into the Compliance Discussion
One of the more significant GAID developments is Article 43 on Emerging Technologies.
It explicitly refers to artificial intelligence, IoT and blockchain where those technologies are used to process personal data. Organizations deploying or planning to deploy these technologies are expected to take the NDP Act, GAID and relevant regulatory requirements into account.
For AI projects, that should move privacy review much earlier in the deployment process.
Consider an AI system used to review customer applications. Before launch, the organization should know what personal data enters the model, whether sensitive information is involved, which provider processes it and whether data leaves Nigeria. The team also needs to consider whether the output contributes to decisions affecting individuals.
The NDPA already contains provisions covering DPIAs and automated decision-making. AI therefore creates new processing scenarios, but it does not sit outside the existing privacy framework.
A useful control is to make privacy assessment part of the AI approval process. Complyan Data Privacy Impact Management can be used to structure assessments, document identified risks and track mitigation before higher-risk processing moves into production
Where Organizations Are Likely to Get This Wrong
AI sits outside the processing records: a chatbot, scoring model, or summarization tool gets treated as an IT purchase and never appears in the record of processing activities, so no DPIA, lawful basis, or transfer assessment exists for it.
Human review exists on paper only: Section 37 expects human intervention that can change the outcome. A reviewer who approves every automated result without the authority or information to overturn it does not meet that expectation.
DCPMI status goes unassessed: GAID expects organizations to assess whether they are a Data Controller or Processor of Major Importance. IOC Law notes that a small workforce does not place an organization outside the regime if it runs a high-volume digital service, which describes most AI-enabled platforms.
Evidence is assembled late: GAID Article 10 requires risk-based compliance audits, and a DCPMI must file an annual Compliance Audit Return. IOC Law states the deadline as 31 March each year for a DCPMI established before 12 June 2023. The 2025 filing window was extended to 30 May 2026, but extensions are not a planning basis.
Building an NDPA Program That Covers AI
Map AI data flows first: training data, prompts, retrieval sources, outputs, and any overseas processing all need a documented path. Complyan’s data flow and mapping tools track data by system and destination, which surfaces transfers a system-level diagram misses.
Put AI in the processing records: Complyan’s data processing activity tools hold the purpose, lawful basis, recipients, and retention for each AI use, so the record an auditor asks for already exists.
Run DPIAs on a defined trigger: Complyan’s data privacy impact management ties an assessment to each AI deployment, with the DPO review GAID requires recorded alongside it.
Treat AI vendors as ongoing risk: Complyan’s third-party risk management monitors sub-processor changes, hosting locations, and incidents after signature, which is where AI vendor risk tends to shift.
Keep audit evidence current: Complyan’s audit and compliance management platform keeps policies, DPIAs, and records mapped and ready, so the annual return reflects the year rather than a final-week reconstruction.
The Cost of Getting It Wrong
IOC Law reports that the maximum remedial fee for a DCPMI is the greater of NGN 10 million and 2 percent of prior-year gross revenue, and for other controllers and processors the greater of NGN 2 million and 2 percent. Orders, compensation claims, and lost customer trust often cost more than the fee itself.
Add these sections after “The Cost of Getting It Wrong” and replace the current short “Bottom Line” with the stronger conclusion below.
Conclusion
Nigeria’s privacy requirements already reach AI systems whenever personal data is involved. Section 37 of the NDPA addresses solely automated decisions with legal or similarly significant effects, while GAID adds clearer expectations around DPIAs, emerging technologies, audit evidence and accountability. NDPA 2026 Compliance in Nigeria…
For organizations deploying AI, the compliance challenge is therefore practical: know what data feeds the system, document what decisions it influences, identify where processing occurs and maintain meaningful human intervention where automated outcomes can materially affect individuals.
The weakest programmes will treat AI as a technology purchase and try to reconstruct the privacy record later. Stronger programmes will put AI deployments into processing records from the start, assess higher-risk use cases before launch and keep evidence current throughout the year. The existing draft already identifies these as key operational requirements under GAID. NDPA 2026 Compliance in Nigeria…