The Nigeria Data Protection Commission (NDPC) has warned that poorly curated data pipelines used to develop advanced artificial intelligence (AI) models could expose Nigeria’s digital ecosystem to automated cyber exploitation and mass disinformation.

The warning was delivered at a Stakeholders’ Consultation on Frontier AI hosted by NITHUB, University of Lagos, and the Tech Governance Project, where the nation’s data protection agency highlighted the security and data protection risks associated with increasingly capable AI systems.

Dr Vincent Olatunji, the National Commissioner and Chief Executive Officer of the Commission, represented by Abubakar Mahmud, an officer in the NDPC’s IT and Cybersecurity Department, made the observation at the consultation.

Olatunji, in remarks delivered on his behalf, highlighted the vulnerabilities associated with uncurated data pipelines used to develop advanced foundation models, warning that they could create opportunities for malicious actors to exploit digital infrastructure and spread disinformation at scale. He said the Nigeria Data Protection Act, 2023, provides an important framework for addressing data governance concerns, particularly through requirements relating to data minimisation and algorithmic transparency.

Olatunji, in remarks delivered on his behalf, highlighted the vulnerabilities associated with uncurated data pipelines used to develop advanced foundation models, warning that they could create opportunities for malicious actors to exploit digital infrastructure and spread disinformation at scale.

He said the Nigeria Data Protection Act, 2023, provides an important framework for addressing data governance concerns, particularly through requirements relating to data minimisation and algorithmic transparency.

“Data protection,” Olatunji says, “is not an impediment to innovation, but rather the foundational infrastructure upon which safe, sovereign and globally trusted AI must be built.”

Foundation models are AI systems trained on large volumes of data and capable of supporting multiple applications, including text generation, image creation, software development and information analysis. The quality, origin and management of their training data can influence their reliability, security and potential to expose sensitive information.

The NDPC’s warning places data governance at the centre of Nigeria’s efforts to harness frontier AI, as governments and technology developers explore how increasingly powerful systems could support economic growth and public services while limiting emerging risks.

Nigeria’s data protection law in focus

Olatunji underscored the requirements of the Nigeria Data Protection Act, 2023, particularly the principles of data minimisation and algorithmic transparency.

Data minimisation requires organisations to limit the collection and processing of personal information to what is necessary for a specified purpose. In AI development, this raises questions about the types of personal data developers collect, how they obtain it and whether its use is justified.

Algorithmic transparency concerns the ability to understand and scrutinise how automated systems operate and how they affect individuals. Its application can help organisations assess the implications of AI systems and strengthen accountability for their use.

The Commission is advocating for the integration of ISO/IEC 42001:2023 into Nigeria’s upcoming AI Regulatory Sandboxing Platform to establish privacy safeguards and accountability mechanisms from the earliest stages of AI development.

ISO/IEC 42001:2023 is an international standard that sets out requirements for establishing, implementing, maintaining and continually improving an AI management system. It provides a framework for organisations to manage risks and responsibilities associated with developing and using AI.

A regulatory sandbox generally provides a controlled environment in which businesses can test innovative products, services or technologies under regulatory oversight. Incorporating AI governance principles into such a platform could help developers evaluate compliance and identify risks before deploying systems more widely.

The NDPC’s remarks present the integration of the standard as a recommendation, rather than confirmation that it has already been formally adopted for the planned platform.

NDPC calls for wider collaboration

Beyond domestic regulation, the commission called for collaboration among government, academia, industry and civil society to address the challenges associated with frontier AI.

Olatunji said the NDPC remained committed to a multi-stakeholder approach involving proactive co-creation, regional harmonisation across Africa and alignment with international standards.

The approach reflects the cross-border nature of AI development, in which training data, computing infrastructure, developers and users may be located in different jurisdictions.

Regional coordination could help African countries develop more consistent approaches to AI governance while addressing local concerns, including personal data protection, cybersecurity and control over digital assets.

The consultation examined the potential of highly capable general-purpose foundation models to support national development, alongside the systemic risks that could emerge as such technologies become more powerful and widely deployed.

For Nigeria, the challenge is to establish safeguards that protect individuals and digital infrastructure without unnecessarily restricting responsible technological development. As Nigeria develops its approach to AI oversight, the proposed regulatory sandbox and the commission’s call for international standards could become important elements of the debate over how to balance innovation, accountability and digital sovereignty.

The consultation reinforced the argument that building public trust in AI will require more than technological advances. It will also depend on how responsibly organisations collect data, manage security risks and account for the consequences of automated systems.