- October 11, 2026
Don’t Put Your Customer Data Into ChatGPT: What Nigerian SMEs Need to Know About AI and Data Privacy
In Part 1, we met Amaka, whose AI-assisted business was quietly outrunning her competitor. This is the part where we make sure that lead doesn’t cost her ₦10 million.
Quick note before we dive in: This article comes with an audio Deep Dive, where we take the conversation a step further—exploring how casual ChatGPT use can trigger ₦10 million NDPA fines, why 77% of employees are pasting data into personal AI accounts, and how to roll out a simple Red/Amber/Green traffic light system so your team can use AI safely without putting customer trust at risk. It’s a relaxed, insightful listen designed to help you build a compliant, tech-forward business
Executive Summary
Nigerian businesses are embracing AI tools like ChatGPT faster than almost anywhere else in the world 1, but most are doing so without realizing the data protection rules that already apply to them. Under the Nigeria Data Protection Act (NDPA) 2023, pasting a customer’s name, phone number, or transaction history into a public AI chat bot can itself be a compliance risk, and the Nigeria Data Protection Commission (NDPC) announced in June 2026 that it is tightening the rules specifically around AI. This article explains what the law actually requires, the real risks of casual AI use, and a simple framework every SME can use to adopt these tools safely.
This is Part 2 of our two-part CreditPRO series on AI for Nigerian SMEs. Part 1, “AI Won’t Replace Your Employees. But an SME Using AI May Replace an SME That Doesn’t,” made the case for why Nigerian SMEs can’t afford to sit out the AI shift, using Amaka, a fast-moving distributor, as an example. This piece is about doing it responsibly, without putting your customers’ trust or data at risk.
77% of employees have pasted data into an AI prompt. Most of them did it from a personal account, with no one in the business ever deciding that was allowed. If that includes your team, you are not alone, and you are not in trouble yet. But it is worth pausing on.
Artificial intelligence has become one of the most accessible business tools available to entrepreneurs. Today, a small business owner can use AI to draft a proposal, analyze information, write marketing content, summarize a document, prepare a presentation, or respond to a customer complaint. The possibilities are enormous.
But there is a question every Nigerian SME should ask before putting information into an AI tool: does this AI tool really need to see this information?
That question becomes particularly important when the information belongs to your customers, employees, suppliers or business partners. A customer’s name, telephone number, identification document, bank details, financial records, address or other personal information is not simply another piece of content to be pasted into a chat bot. It is information that comes with responsibilities. And as Nigerian businesses increasingly adopt AI, those responsibilities deserve more attention.
Imagine a customer sends your business a complaint. You want to use AI to help draft a professional response. There are two very different ways to approach the task.
The first is: “Write a professional response to a customer whose order was delivered late and who is requesting a refund.”
The second is: “Write a response to this customer,” followed by the customer’s full name, phone number, address, transaction history and other personal information.
The first gives AI the problem. The second gives AI the person. In many situations, the AI does not need to know who the customer is to help solve the problem.
That leads to one of the most useful principles for responsible AI adoption: give AI what it needs to perform the task, not everything your business knows.
If a customer’s identity is irrelevant to the task, remove it. If an account number is unnecessary, don’t include it. If a document can be anonymised before analysis, anonymise it. This is not simply an AI principle. It is good data-management practice.
The Nigeria Data Protection Act (NDPA) 2023 established a legal framework for the processing of personal data in Nigeria and created the Nigeria Data Protection Commission (NDPC) as the regulator responsible for data-protection matters 2. The implications extend beyond large banks, telecommunications companies and technology firms. An SME that collects customer information is also participating in the data economy. You may collect:
The fact that your company is small does not make the information less important to the person who entrusted it to you. As AI becomes part of ordinary business operations, SMEs need to consider where personal data goes, who has access to it, why it is being processed, and what controls are in place.
This is a live issue, not a settled one. On June 12, 2026, at the third anniversary of the NDPA’s signing, the NDPC’s National Commissioner, Dr Vincent Olatunji, announced that the Commission is reviewing the Act specifically to address AI, robotics and big data, technologies that barely existed in their current form when the law was drafted in 2023. Olatunji was direct about where this is heading: “Compliance will become a necessity rather than an option” 3.
This is an important question because ChatGPT and other AI tools are becoming part of everyday work. The answer is not that businesses should stop using them. Rather, businesses should understand which AI product they are using and how its data practices work.
AI providers may have different arrangements for consumer, business and enterprise products. For example, OpenAI states that it does not use data from its business, enterprise and API products to train its models by default, a materially different arrangement from its consumer ChatGPT service, which draws on conversations to improve its models unless a user opts out 4. It also provides data controls for users of its consumer products.
But there is an important distinction: the privacy features of an AI provider do not replace your company’s own responsibility for how it handles personal data. An SME still needs to decide:
There is another issue that many SMEs may not have considered. The question may not be “should our employees use AI?” They may already be using it, to draft emails, prepare reports, summarize documents, analyze spreadsheets, create presentations, write marketing copy, prepare customer responses, review contracts, or research competitors. Many of these uses can be perfectly legitimate and productive.
But without clear company guidelines, an employee may also paste sensitive information into an AI tool simply because they are trying to complete their work more quickly. This creates what is sometimes called shadow AI: technology being used inside an organisation without formal approval, oversight or policy.
The scale of this is larger than most business owners assume. Industry research suggests that 77% of employees have pasted data into generative AI prompts, most through personal accounts outside any company oversight, and that over a third of the corporate data entered into AI tools, 34.8%, is now classified as sensitive, up from just 10.7% two years earlier 5. Roughly 40% of uploads to generative AI tools contain personally identifiable or payment card information 5.
34.8%
of the data employees now paste into AI tools is classified as sensitive, more than three times the share from just two years ago. The habit is spreading faster than the guardrails.5
The answer does not necessarily have to be a complete ban. A better approach may be: teach employees what they can use AI for, what they cannot use it for, and how to use it safely.
One way for an SME to make AI data rules easier for employees to understand is to classify information into three broad categories.
Green: Generally Safe. Publicly available information, generic industry research, public marketing material, brainstorming, generic business questions, non-confidential content. For example: “Give me five marketing ideas for a Lagos-based fashion business targeting young professionals.” There is no need to provide personal customer information.
Amber: Use With Caution. Internal business documents, non-public financial information, supplier proposals, pricing information, internal policies, commercial plans, unpublished business information. Before submitting such information, confirm the AI tool’s data practices and whether the use is permitted under company policy. Where possible, sensitive details should be removed: instead of asking AI to analyze a named supplier’s proposal in full, ask it to analyze an anonymised version and identify the commercial risks. The AI may need the content. It may not need the identity.
Red: Do Not Casually Upload. Passwords and authentication credentials, bank-account information, customer identification documents, BVN or other sensitive identifiers, confidential employee records, unredacted customer financial information, or information subject to confidentiality obligations. A useful rule: if a data breach involving the information would seriously concern your customer, employee or business partner, do not casually paste it into an AI chat bot.
There is a simple concept behind all of this: data minimisation. If you only need five pieces of information to complete a task, there is little reason to provide fifty.
Suppose an SME wants AI to analyze its overdue invoices. It may need the invoice amount, invoice date, due date, payment status and customer category. It may not need the customer’s full name, phone number, home address, bank details or identification number. The same analysis can potentially be performed without exposing unnecessary personal information. Less data can mean less risk.
An SME does not necessarily need a complicated 50-page AI manual. A simple policy can answer six questions:
The worst outcome is an employee thinking, “if I tell management, I’ll get into trouble, so I won’t say anything.” The better culture is: “report it quickly so we can assess and manage the risk.”
Under Section 25 of the NDPA, businesses need a lawful basis for processing personal data; Section 27 requires transparency about automated decision-making; Section 37 protects individuals from decisions based solely on automated processing; and high-risk processing requires a Data Protection Impact Assessment 6. Under Section 48, a data controller of “substantial importance” can face fines of up to ₦10 million or 2% of annual gross revenue, whichever is greater 6.
This is not a theoretical concern. Nigerian regulators have already shown they will levy significant penalties over data handling: the Federal Competition and Consumer Protection Commission’s $220 million fine against Meta/WhatsApp over data and consumer protection breaches was upheld by an appeal tribunal 7, and the NDPC issued the country’s largest data-protection fine to date, ₦555.8 million against Fidelity Bank, though the bank disputes the allegations 8.
AI can generate an answer. It does not automatically make that answer correct. AI can summarize a document. It does not automatically make the summary accurate. AI can draft a customer response. It does not automatically make the response appropriate. And AI can process information. It does not mean the business should automatically act on the result.
For important decisions, human oversight remains critical, especially where AI touches customers, employees, financial decisions, credit, compliance, contracts, or sensitive personal information. A useful model: AI assists. Human reviews. Business decides.
It is important not to misunderstand the message. This is not an argument for Nigerian SMEs to avoid AI. Quite the opposite. Nigeria’s National Artificial Intelligence Strategy recognizes AI as an important opportunity for economic development, innovation, productivity and competitiveness, while also emphasizing a human-centered, responsible and ethical approach to adoption 9.
The opportunity is enormous. AI can help a small business conduct research faster. It can help employees produce better first drafts. It can improve customer-service workflows. It can help management analyze information. It can reduce repetitive work. But responsible adoption means understanding that data is an asset with obligations attached to it, and the businesses that build this discipline now will be the ones able to adopt increasingly powerful AI tools with confidence, while competitors who never built it will eventually be forced to retrofit it under regulatory pressure.
At CreditPRO, we believe innovation should strengthen the businesses we serve. We increasingly see data handling practices as part of what makes a business credit-ready: a company that can show it manages customer data responsibly, including how it uses AI tools, signals the same operational discipline that lenders look for in financial statements and repayment history. It is the same standard we hold ourselves to, you can see how we handle personal data in our own Privacy Policy. For Nigerian SMEs, responsible AI adoption means embracing technology while building the systems, controls and discipline required to grow sustainably. Our team is always glad to talk through what that looks like for your business, whether the conversation is about financing or the safeguards behind it.
Before putting information into an AI tool, ask three questions:
If the answer to any of these questions is no, stop and reconsider. The future of business will involve more AI, not less. The businesses that benefit most will not necessarily be those that use AI most aggressively. They will be those that learn to use it productively, responsibly and intelligently. Use AI. But protect the trust that makes your business possible.
Amaka, from Part 1, is still ahead of Tunde. But she stays ahead because she paired speed with discipline, not because she moved fastest and asked questions later. That is the difference this series has been about all along.
Sources & References
[1] The Condia, “Nigeria leads Global AI adoption in 2026, Google Ipsos report finds.” https://thecondia.com/nigeria-ai-boom-2026-google-ipsos-report/
[2] Nigeria Data Protection Commission (official), “About Us.” https://ndpc.gov.ng/about-us/
[3] THISDAYLIVE, “NDPC Unveils Plans to Review Data Protection Act to Address AI, Robotics, Other Emerging Technologies,” June 21, 2026. https://www.thisdaylive.com/2026/06/21/ndpc-unveils-plans-to-review-data-protection-act-to-address-ai-robotics-other-emerging-technologies/
[4] OpenAI (official), “Enterprise privacy at OpenAI.” https://openai.com/enterprise-privacy/
[5] Unio Digital, “What Employees Share with ChatGPT: 2026 Sensitive Data Statistics.” https://unio.digital/chatgpt-sensitive-data
[6] Mondaq / OAL, “AI, Big Data, And The NDPA: Nigeria’s Data Protection Rules Are About To Get Stricter.” https://www.mondaq.com/nigeria/data-protection/1808954/ai-big-data-and-the-ndpa-nigerias-data-protection-rules-are-about-to-get-stricter
[7] Federal Competition and Consumer Protection Commission (official), “Violations: Tribunal Upholds FCCPC’s $220 Million Fine Against Meta/WhatsApp.” https://fccpc.gov.ng/violations-tribunal-upholds-fccpcs-220-million-fine-against-meta-whatsapp/
[8] Business-day NG, “Fidelity Bank denies NDPC data breach allegations.” https://businessday.ng/news/article/fidelity-bank-denies-ndpc-data-breach-allegations/
[9] Federal Ministry of Communications, Innovation and Digital Economy (official), “National Artificial Intelligence Strategy (NAIS).” https://fmcide.gov.ng/initiative/nais/
About the Author
Anthony Jiboye is the Head of Growth and Customer Experience at CreditPRO Finance Company Limited. With a proven track record in driving business expansion, customer retention strategies, and service excellence, Anthony leads CreditPRO’s growth initiatives to deliver seamless, customer-centric financial solutions. He is passionate about scaling innovative financial products, enhancing user journeys, and empowering businesses across Nigeria to access reliable funding and growth opportunities.
