There is a question that most Nigerian small business owners have not asked themselves, and the longer they leave it unanswered, the more expensive the consequences become. The question is simple: when your staff paste a customer’s name, phone number, financial details, or contract terms into an AI tool, where does that information go, who can access it, and what does Nigerian law say about your responsibility for it?
The answer to the last part of that question is unambiguous. The Nigeria Data Protection Act 2023, the most comprehensive data protection legislation in Africa, applies to every business that collects, stores or processes personal data belonging to Nigerian residents, and it applies to AI tools exactly as it applies to any other system that handles customer information. The penalty for non-compliance is two per cent of annual gross revenue or 10 million naira, whichever is greater, plus criminal liability for wilful violations. The law has been in force for three years. Most Nigerian SMEs using AI tools today have not read it.
This gap between adoption and governance is not unique to Nigeria, but it is particularly pronounced here. Research published this week by ITWeb Africa and Veeam Software, drawing on a joint survey of enterprise decision-makers across the continent, found that African businesses are accelerating their AI ambitions without building the data governance foundations those ambitions require. Separately, a study of Nigerian and South African SMEs found that only nine per cent have embedded AI into daily operations while seventy per cent remain stuck in early maturity, using AI sporadically rather than systematically. That combination, low embedded adoption alongside poor data governance, creates a specific and underappreciated risk for small businesses that are quietly feeding customer data into tools they do not fully understand.
The nature of that risk deserves to be stated precisely. When a Nigerian SME owner uses a free consumer AI chatbot to draft a customer proposal and pastes in the client’s personal details, that activity constitutes data processing under the Nigeria Data Protection Act. The business becomes accountable for how that data is handled by the tool it chose to use. Free consumer versions of AI tools and licensed business tiers carry fundamentally different data commitments. A consumer chatbot may use the information entered into it to train future models, share it with third parties, or retain it in ways the business owner has not agreed to and may not be aware of. Under Section 25 of the NDPA, data processing requires a lawful basis. Under Section 37, individuals have the right not to be subjected to significant decisions made solely through automated processing. A small business using AI to screen job applicants, assess customer creditworthiness, or make pricing decisions based on customer profiles may be violating that provision without knowing the provision exists.
The Nigeria Data Protection Commission has already demonstrated that it will enforce the law against organisations that fall short. In July 2025, the NDPC fined Multichoice 766 million naira for unlawful data transfers and intrusive data processing affecting subscribers. That penalty was applied to a large corporation. The NDPC announced in June 2026 that it is reviewing the NDPA specifically to address AI, robotics, and big data more explicitly, signalling that enforcement attention on AI-related data processing is intensifying rather than relaxing. Nigeria is also not alone in this direction. Governments in Angola, Mauritius, Kenya, South Africa, and Botswana are all revising data protection laws to address AI-driven decision-making, data scraping, and algorithmic accountability. The regulatory environment around AI and data is tightening across the continent simultaneously.
For Nigerian SMEs, the practical implications run across every function where AI is being used. Customer service tools that handle enquiries through automated chat are processing personal data and require a documented lawful basis for doing so. AI-assisted bookkeeping platforms that ingest transaction records and customer financial information must comply with the Act’s security and retention requirements. Marketing tools that use customer purchase history to generate personalised content are engaged in profiling, which carries specific obligations under Nigerian data protection rules. Recruitment screening tools that use AI to filter applications are making automated decisions with significant consequences for job applicants, triggering Section 37 protections directly.
There is also a technical dimension to the risk that goes beyond legal compliance. A benchmarking study by Intron found that a leading global AI model produced a 53.8 per cent error rate across African languages, compared with 34.3 per cent for a model built specifically for the region. A small business owner using a global AI tool to communicate with customers, draft contracts, or analyse locally contextualised data is working with technology that gets the answer wrong more than half the time in African language contexts. The data governance problem and the accuracy problem are related: a business that does not understand how its AI tool handles data is also unlikely to be systematically testing whether that tool produces reliable outputs for Nigerian business contexts.
None of this is an argument against using AI tools. The productivity gains available to a small business that deploys AI thoughtfully are real, and the competitive disadvantage facing businesses that ignore AI entirely is growing every month. The argument is about the order of operations. AI adoption is a data governance exercise before it is a technology exercise. A business that selects an AI tool before understanding what data it will process, on what legal basis, under what security conditions, and with what disclosure to the customers whose information is involved, is not behind on technology. It is ahead on risk.
The practical starting point for any Nigerian SME currently using or considering AI tools is three steps. First, identify what personal data the business holds and where it currently sits, because AI tools can only be governed if the business knows what information it is putting into them. Second, give staff written guidelines on what may and may not be entered into AI tools. Sensitive customer records, financial credentials, health information, and confidential contracts should not be processed through consumer AI platforms without explicit data processing agreements in place. Third, choose business-licensed versions of AI tools that carry explicit data terms rather than free consumer versions whose terms are designed for individual use rather than business accountability.
The NDPC is building the enforcement infrastructure to monitor compliance more systematically, and the planned revision of the NDPA to address AI directly will sharpen the obligations on businesses that process personal data through automated systems. A small business that has not yet addressed its AI data governance posture is not waiting for future regulation. It is already operating outside the requirements of a law that has been in force since 2023 and being enforced with penalties calculated as a percentage of revenue, not as a flat fee.
The gap between how fast Nigerian SMEs are adopting AI and how carefully they are managing the data that powers it is where the next significant wave of regulatory risk is quietly building. The businesses that close that gap now will not simply be compliant. They will be the ones their customers can trust with their information, which in a market where trust is hard to build and easy to lose, is a competitive advantage that compounds over time.