Nigeria NDPA 2023 and generative AI: what fintech teams need to know
NDPA 2023, the NDPC's GAID directive, BVN and NIN: how Nigerian fintechs and banks can use ChatGPT or Copilot without exposing their customers' data.
In Lagos, a compliance analyst at a fintech pastes a transaction export into ChatGPT to understand a run of failed payments. The spreadsheet holds names, account numbers and BVNs. The answer comes back in seconds. The data has just left the company, and nothing records it.
That everyday move is now closely regulated. Since the Nigeria Data Protection Act of 2023 and the General Application and Implementation Directive (GAID), in force since September 2025, the Nigeria Data Protection Commission (NDPC) expects organisations to prove they control their processing, including when an employee uses an AI assistant.
The framework: NDPA 2023, NDPC and the GAID
The Nigeria Data Protection Act was signed into law in June 2023. It created the NDPC as the independent authority in charge of enforcement and replaced the earlier regime built on the 2019 NDPR.
In March 2025 the NDPC issued the General Application and Implementation Directive, which took effect on 19 September 2025. It spells out how the Act works day to day: registration of controllers, annual audits, impact assessments and the role of the DPO. With it, the NDPR and its 2020 implementation framework stop being the regulatory reference.
BVN and NIN: identifiers that need extra care
Two identifiers show up in almost every customer file in Nigeria. The BVN (Bank Verification Number) links each bank customer to their biometric data. The NIN (National Identification Number), issued by NIMC, is the identity key for opening accounts, registering SIM cards and accessing many public services.
These numbers give access to a complete identity, and a leak opens the door to impersonation and fraud. The NDPA lists biometric data as sensitive personal data, which calls for stronger safeguards. In practice, a BVN or NIN inside a prompt should be handled as high risk data, just like a medical record.
Yet these identifiers are everywhere: support tickets, KYC exports, fraud reports. That is exactly the material teams want to summarise with an AI assistant.
What the GAID means for AI
The GAID is one of the few African texts that deals directly with emerging technology. Before deploying AI, the Internet of Things or blockchain, an organisation must carry out a Data Protection Impact Assessment (DPIA). Profiling, automated decision making and systematic monitoring are among the triggers.
The assessment must cover privacy by design, security, transparency and risk mitigation. It has to be reviewed by a DPO and included in the audit report. In plain terms, a fintech that lets staff use ChatGPT, Copilot or Gemini on customer data must be able to show it assessed that risk and put safeguards in place.
Registration, audits and penalties
Organisations classed as data controllers and processors of major importance must register with the NDPC and, depending on their tier, file an annual Compliance Audit Return by 31 March through a licensed compliance organisation. They must also appoint a DPO.
The penalties are real. For these organisations the Act sets a fine of up to the higher of 10 million naira or 2% of annual gross revenue. The NDPC has already announced large fines, including 555.8 million naira against Fidelity Bank in 2024, which the bank disputed, and 766 million naira against MultiChoice in 2025.
A personal data breach must also be reported to the Commission within 72 hours. An employee who pastes BVNs into a public AI tool can trigger that duty without anyone noticing.
Why legacy tools fall short
Many Nigerian banks already run DLP on email or the network. Those tools see very little of what happens inside an encrypted browser window, where users type or paste text. We cover this in our piece on the anatomy of an AI data leak.
Banning ChatGPT does not solve it either. Staff switch to their phones or personal accounts and the company loses all visibility. This is shadow AI, and we have put numbers on its real cost for businesses. The same pattern holds across the region, as our overview of AI and data protection in West Africa shows.
A five step approach for a fintech
Map usage: which AI tools are used, by which teams, on which kinds of data.
Classify identifiers: put BVN, NIN, account numbers, card numbers and biometric data in the highest category.
Run the DPIA the GAID requires for AI use, signed off by the DPO.
Protect at the endpoint: detect and anonymise sensitive data before the prompt is sent, then warn or block as needed.
Keep evidence: log incidents to feed the annual audit return and answer the NDPC.
Anonymisation is often the best option because it lets people keep working. Replacing a BVN with a fake value in the same format lets the AI analyse the spreadsheet without ever seeing the real number. Our guide to format preserving anonymization explains how it works.
Key takeaways
The NDPA 2023 and the GAID, in force since September 2025, are the reference framework in Nigeria.
The GAID requires a DPIA before any AI deployment.
BVN and NIN must be protected as high risk data.
NDPC fines and the 72 hour breach notice make prevention essential.
ZeusLock detects and anonymises BVNs, NINs and other sensitive data right on the device, before they reach ChatGPT, Copilot or Gemini, and keeps the evidence for your audits. Book a demo to see how it fits your teams.
Protect your data from AI leaks
See ZeusLock stop sensitive data before it reaches ChatGPT, Claude, Gemini and more, in a 30-minute demo.
