AI chatbots handle customer names, phone numbers and sometimes payment or health details. In Nigeria that brings two sets of rules into play: data protection under the Nigeria Data Protection Act 2023 (NDPA), enforced by the Nigeria Data Protection Commission (NDPC), and consumer protection under the Federal Competition and Consumer Protection Act, enforced by the FCCPC.
This is a practical guide, not legal advice. For complex cases, speak with a data protection lawyer or a licensed Data Protection Compliance Organisation (DPCO).
1. Tell customers they are talking to AI
Being clear that the assistant is AI, and that a person is available, is part of treating consumers fairly. The FCCPC has also issued draft guidance on the use of AI in advertising and marketing, which points the same way. A simple first message works: “Hi, I am the AI assistant for CarePoint Clinic. A member of staff can take over at any time.”
2. Have a lawful basis and a privacy notice
Under the NDPA you need a lawful basis for processing customer data, such as responding to their request or a contract. Your chatbot should link to a short privacy notice explaining what you collect, why, who you share it with and how long you keep it.
3. Collect only what you need
A booking needs a name, phone number and time. It does not need a date of birth or address unless the service requires it. Less data means less risk.
4. Be careful with sensitive data
Health, religion and children’s data need extra care. Clinics should keep diagnosis and results out of the chatbot. Schools should keep pupil records out entirely. The assistant should hand these conversations to a person.
5. Sign a data processing agreement
If an agency or software provider runs the chatbot for you, they are processing data on your behalf. The NDPA expects a written agreement covering security, confidentiality and what happens to the data when the contract ends.
6. Marketing messages need consent
Promotional WhatsApp or SMS messages should go only to customers who agreed to receive them, with an easy way to stop. This is also WhatsApp’s own policy, and breaking it can get your number restricted.
7. Check whether you must register or file an audit
Under the NDPA and the GAID 2025, organisations that process personal data at certain volumes are classed as of major importance and must register with the NDPC and file compliance audit returns. Check the current thresholds with the NDPC or a DPCO.
8. Keep a person in charge
Do not let an AI make important decisions about customers, such as refusing a refund or a loan, without human review. Use clear handover rules.
Quick checklist
- AI disclosure in the first message
- Privacy notice link
- Minimum data collected
- Sensitive topics handed to staff
- Data processing agreement with your provider
- Opt-in records for marketing
- NDPC registration checked
Every assistant we build follows these rules. Read how we work, or add our AI compliance pack from the pricing page.
See what AI could take off your team
Tell us about your business and the messages you get. Within one working day we send a short audit with the two or three jobs AI can handle, and what each would cost.
Get a free AI audit