Data Protection for Nigerian Banks Using AI: NDPA, CBN, and GDPR in One Framework

Nigerian banks deploying AI operate under three regulatory frameworks simultaneously. The NDPA 2023 governs personal data processing. CBN directives govern banking operations and financial data. And GDPR reaches in if you serve EU customers or use EU-based infrastructure.

Most banks treat these as separate compliance workstreams. That's expensive, slow, and creates gaps at the intersections. Here's how to build one framework that covers all three.

The three regulatory layers

Layer 1: NDPA — data protection

Every AI system in your bank that processes personal data falls under the NDPA. That includes:

• Customer onboarding (KYC data, identity documents, biometrics)
• Transaction monitoring (AML/CFT automation)
• Credit scoring and lending decisions
• Fraud detection
• Customer service chatbots
• Internal HR and employee management systems

NDPA requires: lawful basis, privacy notices, DPIAs for high-risk processing, DPO appointment, annual CAR filing, cross-border transfer safeguards, and data subject rights processes.

Layer 2: CBN — banking regulation

CBN doesn't regulate data protection directly, but its directives create data processing obligations:

AML/CFT requirements:

• Transaction monitoring — mandatory automated systems by June 2026
• Customer due diligence (CDD) — collecting and verifying identity data
• Suspicious Transaction Reports (STRs) — sharing personal data with NFIU
• Record retention — 5 years minimum for transaction records

Know Your Customer (KYC):

• Identity verification (BVN, NIN, documents)
• Enhanced due diligence for high-risk customers
• Ongoing monitoring of customer relationships

Risk management:

• Model risk management for AI systems used in decision-making
• Senior management accountability for AI outcomes
• Regular model validation and testing

Layer 3: GDPR — extraterritorial reach

GDPR applies if your bank:

• Serves diaspora customers in the EU (remittance services, accounts for Nigerians in Europe)
• Partners with EU financial institutions (correspondent banking, payment processing)
• Uses EU-based cloud infrastructure (AWS Ireland, Google Cloud Europe)
• Processes data of EU residents for any reason

Understanding where NDPA and GDPR diverge is essential for building a unified framework.

Where the frameworks conflict

Data retention

CBN says: Keep transaction records for at least 5 years. AML requirements may extend this further.

NDPA says: Don't keep data longer than necessary for the purpose it was collected.

GDPR says: Same as NDPA — storage limitation, delete when no longer needed.

Resolution: The CBN legal obligation provides a lawful basis for 5-year retention of transaction records under both NDPA and GDPR. But retention of non-transaction data (browsing behaviour, app usage, marketing preferences) has no CBN justification — apply NDPA/GDPR minimisation principles to everything CBN doesn't specifically require.

Document this explicitly in your retention policy: "Transaction records: 5 years (CBN AML requirement). Marketing data: 12 months from last interaction (NDPA/GDPR minimisation)."

Data sharing with regulators

CBN requires: Sharing customer data in STRs with NFIU. Providing data to CBN examiners on request.

NDPA/GDPR: Data sharing needs a lawful basis. Regulatory obligation provides this — but you must document it and inform customers.

Resolution: Include regulatory sharing in your privacy notice: "We may share your personal data with the Central Bank of Nigeria, NFIU, and other regulators as required by law." This satisfies NDPA/GDPR transparency requirements while maintaining CBN compliance.

Automated decision-making

CBN expects: Banks to use automated systems for AML monitoring and risk assessment. Automation is increasingly mandated, not optional.

NDPA/GDPR: Individuals have rights around automated decision-making — the right to human review, explanation of logic, and the right to contest decisions.

Resolution: Build human-in-the-loop mechanisms into every AI decision pipeline. The AI flags suspicious transactions; a human reviews and decides. The AI produces a credit score; a human reviews before declining an application. This satisfies both CBN's automation mandate and NDPA/GDPR's human oversight requirements.

Building the unified framework

One DPO, three frameworks

Your DPO should understand all three regulatory layers. A DPO who only knows NDPA can't assess whether your AML data retention is proportionate. A DPO who only knows GDPR won't handle the DPCO filing.

For a bank, the DPO role is complex enough to justify a senior hire or a specialist outsourced service rather than someone splitting the role with other duties.

One DPIA template, comprehensive coverage

Every AI system gets one DPIA that covers:

• NDPA requirements (data flows, lawful basis, Nigerian data subject impact)
• GDPR requirements (transfer impact, EU data subject rights, automated decision-making)
• CBN context (regulatory obligation, AML/CFT purpose, model risk)

Don't write separate DPIAs for each framework. One document, three sections.

One privacy notice, all disclosures

Your customer privacy notice should cover:

• NDPA disclosures (data controller identity, NDPC as regulator, Nigerian rights)
• GDPR disclosures (EU data subject rights, cross-border transfers, right to lodge complaint with EU DPA)
• CBN context (regulatory data sharing, AML monitoring disclosure)
• AI disclosures (automated decision-making, profiling, right to human review)

Unified records of processing

One register covering every processing activity with columns for:

• Processing purpose
• Lawful basis under NDPA
• Lawful basis under GDPR (if applicable)
• CBN regulatory requirement (if applicable)
• Data categories and retention periods
• International transfers and safeguards

AI systems that need specific attention

Credit scoring

An AI credit scoring system hits all three frameworks hardest:

• NDPA: DPIA required, automated decision-making rights, data subject can request human review
• GDPR: Article 22 rights, meaningful explanation of logic required, right to contest
• CBN: Transparency requirements for lending decisions, model validation, fair lending obligations

Build explainability into the model from day one. A black-box credit scorer that can't explain why it declined someone fails under all three frameworks.

AML/CFT monitoring

Your automated transaction monitoring system:

• CBN: Mandatory by June 2026. Must detect structuring, velocity anomalies, sanctions hits.
• NDPA: Processes personal data at scale — DPIA required. Legitimate interest or legal obligation as lawful basis.
• GDPR: If monitoring EU customer transactions — same DPIA and lawful basis requirements.

The CBN AML deadline is the most urgent driver. But building the system without NDPA/GDPR documentation means you'll be retrofitting compliance after deployment — more expensive and more risky.

Customer chatbots

AI chatbots on WhatsApp or your banking app:

• NDPA: Privacy notice before first interaction, DPIA, DPA with AI provider, conversation retention limits
• GDPR: Same plus cross-border transfer documentation if AI provider is outside EU
• CBN: If the chatbot handles account queries, it's processing regulated financial data. Access controls and audit logging required.

The compliance calendar

For a Nigerian bank using AI:

Obligation	Framework	Frequency
CAR filing (through DPCO)	NDPA	Annual — March 31
DPO registration review	NDPA	Annual
DPIA reviews (all AI systems)	NDPA + GDPR	Annual or on significant change
AML system validation	CBN	Annual minimum
Privacy notice review	NDPA + GDPR	Annual
DPA reviews (AI providers)	NDPA + GDPR	Annual or on contract renewal
Data retention audit	All three	Annual
Staff training	All three	Annual
Breach response drill	NDPA + GDPR	Annual recommended

Getting started

1. Appoint or upgrade your DPO — they need to understand all three frameworks, not just one
2. Map every AI system against all three regulatory layers — most banks don't know what they have
3. Conduct unified DPIAs — one assessment per AI system, covering NDPA + GDPR + CBN
4. Build human oversight into every automated decision pipeline
5. Document retention justifications — where CBN requires 5 years, document it; where it doesn't, apply minimisation
6. Prepare for CBN June 2026 — the AML automation deadline with NDPA/GDPR documentation built in from the start

---

Need a unified data protection framework for your bank's AI systems? We advise across NDPA, GDPR, and CBN — one adviser, one programme, three regulatory layers covered. Nigerian lawyer (BL), CIPP/E certified, 10+ years in financial services compliance. Get in touch.