Nigerian workers using artificial intelligence tools such as ChatGPT, Google Gemini, and Claude at work may be exposing themselves and their employers to data privacy risks under the Nigeria Data Protection Act 2023, even though the country lacks a comprehensive standalone AI law. The Act provides safeguards against automated decision-making involving personal data, which could affect how companies use AI in recruitment, employee monitoring, and performance analysis.
Data Protection Act Limits Solely Automated Decisions
Section 37 of the Nigeria Data Protection Act gives individuals the right not to be subjected to a decision based solely on automated processing, including profiling, where that decision produces legal or similarly significant effects. This provision becomes particularly relevant as Nigerian companies increasingly adopt AI in human resources and recruitment.
According to a report by MyBroadband, affected individuals have rights under the Act, including obtaining human intervention, expressing their point of view, and contesting an automated decision. This means employers must think carefully before allowing algorithms alone to determine consequential employment outcomes, such as hiring, promotion, or termination.
Recruitment and Employee Monitoring Risks
Recruitment presents one of the clearest areas of risk. A company receiving thousands of applications may be tempted to use AI to automatically rank candidates and eliminate applicants before a human recruiter reviews their CVs. However, Nigeria's regulatory framework places additional obligations around higher-risk processing.
The Nigeria Data Protection Commission's General Application and Implementation Directive identifies evaluation or scoring, automated decision-making with significant effects, and systematic monitoring as circumstances where a Data Privacy Impact Assessment is mandatory. The NDPC's 2026 journal also says organisations deploying emerging technologies involving personal information should consider people's rights concerning solely automated decisions and assess risks, including biased or unintended outcomes.
What Workers Should Avoid Feeding AI Systems
The issue extends beyond recruitment. Employees increasingly use generative AI to analyse spreadsheets, rewrite correspondence, summarise meetings, and prepare reports. Problems can arise when workers paste customers' or colleagues' personal information into externally operated AI systems without appropriate safeguards, especially when documents contain sensitive or highly personal information.
Rather than banning AI outright, companies can establish clear rules governing which information workers are permitted to submit to external AI platforms and when additional approval or safeguards are required. This approach allows businesses to benefit from AI productivity gains while managing data protection obligations.
Employers Face New Responsibilities
For Nigerian businesses, AI offers potentially substantial productivity gains, but adopting it also creates new responsibilities. The NDPC says its regulatory processes now include Data Privacy Impact Assessment administration and sandboxing for emerging technologies and innovative data uses, reflecting growing regulatory attention to new technologies.
For workers, the practical message is straightforward: using AI to improve routine work is different from feeding confidential or personal information into an external system. For employers, allowing AI to influence who gets hired, promoted, or otherwise subjected to a consequential workplace decision requires particular care.
The issue has also drawn international attention. Legit.ng earlier reported that three of the world's leading artificial intelligence executives appeared before the UN Security Council on September 23, 2026, with each calling for greater cooperation and restraint in how the technology is developed and deployed. OpenAI Chief Executive Officer Sam Altman told the UN council that AI should expand human capability rather than reduce people to passive participants in automated systems.
