ABSTRACT
Imagine you apply for a loan through a mobile app. Four seconds later, your application is rejected. No human being reviewed it; an automated system made the decision. Under section 27(1)(g) of the Nigeria Data Protection Act 2023, you must be informed that automated decision-making is being used, what it means, what its likely consequences are, and that you have the right to object. Section 34(1)(a)(viii) also allows you to request this information later. But there is one crucial question the law does not expressly give you the right to have answered: Why was your loan rejected?
The corresponding GDPR provisions require meaningful information about the logic involved in automated decision-making. Sections 27(1)(g) and 34(1)(a)(viii) of the NDPA contain similar disclosure requirements but omit that express wording. The omission appears in both provisions, although the text alone does not establish why it occurred. Nigeria took the rest of the wording and left that phrase out of both. Because it is missing from the notice duty and the access right alike, this looks like a drafting decision rather than an accident.
This article argues that the General Application and Implementation Directive 2025 spotted the gap and filled it in the wrong place. Article 41(2)(c)(ii) requires controllers to disclose what their technology can do, particularly where algorithms are used for profiling. But Article 41 is headed “Data Ethics, Privacy and Dignity of the Human Person”. However, Article 41 does not expressly establish a standalone right to an explanation. Although its transparency provisions may support enforcement under the Act, the route is less direct than a right clearly recognised in the law. The missing safeguard has therefore been partly addressed, but its status as an individual entitlement remains uncertain.
Three features make this worse: section 37(1) applies only where a decision is made “solely” by machine, and nothing says what human input removes it from that description; The contract exception in section 37(2)(a) may also limit the protection available in lending and insurance decisions, depending on whether automated decision-making is necessary for the relevant contractual purpose; and the emerging-technology paperwork is filed through returns that only the two largest categories of controllers submit. South Africa provides a useful legislative model: its 2013 law expressly links the right to make representations with access to information about the underlying logic of automated processing. The authors propose measures the Commission may consider under its existing powers, while arguing that an amendment to the Act would provide the clearest basis for establishing an express individual right to an explanation.
1. INTRODUCTION
Imagine you apply for a loan through a mobile app. Four seconds later, your application is rejected. No human reviews it; a machine makes the decision.
Section 37(1) of the Nigeria Data Protection Act 2023 gives you the right not to be subject to certain decisions made entirely by automated systems, including profiling, where they have legal or similarly significant effects.1 Section 27(1)(g) requires you to be informed beforehand about such decisions, their meaning and likely consequences, and your right to object and challenge them.2 Section 34(1)(a)(viii) also allows you to request this information later.3
But here is the problem: you can learn that a machine rejected your application and understand the consequences, yet still have no clear right to know why. It is like failing an examination and being allowed to appeal without knowing which answers were wrong. The corresponding GDPR provisions require meaningful information about the logic involved in automated decision-making. Sections 27(1)(g) and 34(1)(a)(viii) of the Nigerian Act contain similar disclosure requirements but omit that express wording.4 The omission appears in both provisions, although the text alone does not establish why it occurred.
This article examines that omission, the Nigeria Data Protection Commission’s partial response, and the reforms needed to address the gap. It also considers three related weaknesses, compares Nigeria’s framework with those of Kenya and South Africa, and proposes reforms using existing legal powers. The analysis is based on the Nigeria Data Protection Act 2023, the Directive issued in March 2025, and the relevant laws of the two comparator countries.
2. WHAT THE ACT GIVES
The structure will be familiar. Section 65 defines automated decision-making as a decision taken only by automated means, with no human involvement at all.5 Section 37(1) gives the right not to be subject to such a decision where it has legal or similarly serious effects. Section 37(2) removes that right in three situations: where the decision is needed to enter into or perform a contract with the controller, where a written law allows it and sets out safeguards, and where the person has consented.6 Section 37(3) then requires the controller to put suitable measures in place to protect the person, including the right to ask for a human to intervene, the right to put her side of the story, and the right to challenge the decision.7
One feature of that structure deserves credit, and it is rarely noticed. Article 22(3) of the European Regulation limits its equivalent safeguards to two of its three exceptions, so a decision authorised by law attracts only whatever safeguards that law happens to provide. Section 37(3) carries no such limit.8 On its wording, the right to human intervention, the right to be heard and the right to challenge apply in every case where section 37(2) is engaged, including the statutory one. That is a real improvement on the model, and an article that criticises the rest of the transposition should say so first.
The transparency provisions complete the picture. Section 27(1)(g) is a notice duty owed before data is collected. Section 34(1)(a)(viii) forms part of the right of access. Between them, they ensure a person knows that automated decision-making is happening, understands what it means and what it may lead to, and knows she can object.
That is a coherent scheme and, for many purposes, a sufficient one. The difficulty only appears when one asks what the section 37(3) rights are actually worth without the information needed to use them. The right to explain your position is easier to exercise when you know what the decision was based on. Similarly, a challenge is more effective when you can identify the possible error. Without meaningful information about the factors considered, these rights may be harder to exercise effectively, even though they remain legally available.
3. THE MISSING PIECE
The European law on which sections 27 and 34 of the Nigeria Data Protection Act 2023 are based requires three things: information that automated decision-making is being used, an explanation of the logic behind it, and its likely effects on the person concerned.9 Nigeria retained the first and third requirements but left out the second in both sections. Since the same omission appears in both provisions, it is difficult to treat it as an accidental drafting error. This article does not speculate on why it happened.
The problem is that knowing the outcome is not the same as knowing the reason. Imagine you apply for a loan and your application is rejected. You are told what the decision means for you, but not whether it was based on your repayment history, spending patterns, or the device you used.
Without that information, your right to object or challenge the decision becomes difficult to exercise. You cannot point out incorrect information or explain why the system may have judged you unfairly. The law gives you the right to challenge the decision but does not clearly give you the information needed to do so effectively. It is like being sent off a football pitch without being told what rule you broke. You can protest, but you cannot properly defend yourself.
Section 24(3) makes this gap more serious by requiring controllers to demonstrate accountability. A controller may demonstrate accountability through internal records, audits and impact assessments. However, those measures do not necessarily tell the affected person why a particular decision was made. Internal accountability and individual transparency serve different purposes, and both matter.10 One possible objection is that explaining complex AI systems may be difficult. However, an explanation does not necessarily require disclosure of source code or technical details. For example, a controller could explain that a loan application was assessed using repayment history, transaction patterns and other relevant information, and identify the main factors that influenced the result. The person should receive enough understandable information to recognise possible errors and make a meaningful challenge. The level of detail required may depend on the decision and the system used. But explaining a decision does not require revealing source code or technical details. For example, a controller could explain that a loan application was assessed using repayment history, transaction patterns, and other relevant information, and identify the main factors that influenced the result. This would help the applicant understand the decision without requiring disclosure of the source code. This would help you understand the decision without exposing the entire system.
The issue is not whether every technical detail should be disclosed. It is whether the person receives enough understandable information to identify the main factors behind the decision, recognise possible errors and make a meaningful challenge. The required level of detail may depend on the decision and the system used.
4. THE DIRECTIVE’S ANSWER, AND WHERE IT SITS
The Nigeria Data Protection Commission has partly addressed the transparency concern. Article 41(2)(c) of the Directive requires disclosure of the capabilities of the technology used for processing, particularly where algorithms are used for profiling, together with the risks involved and their mitigation. However, these requirements do not expressly establish an individual right to receive meaningful information about the factors behind a particular automated decision.11
However, Article 41 appears under “Data Ethics, Privacy and Dignity of the Human Person” and is framed as an ethical standard, not a direct legal right. This distinction matters.12 Part VI of the Act provides a framework for enforcing data subject rights, including complaints under section 46 and damages under section 51 where the legal requirements are met.13 Article 41 does not expressly establish a standalone right to an explanation, although its transparency provisions may support enforcement through section 24(1)(a).14 The difficulty is therefore not that enforcement is necessarily impossible, but that the right to meaningful information about a particular automated decision is not clearly stated as an individual entitlement.
There is also no clear standard showing how much explanation is enough. Article 41 does not clearly define what information an individual must receive about a particular automated decision. Although the Commission may interpret and enforce applicable transparency duties, the absence of an express individual right leaves uncertainty about the level of explanation required. This may allow controllers to provide different levels of detail in similar cases.
This is especially concerning in areas such as loan applications, insurance pricing, tenancy checks and fraud detection, where automated decisions affect many people who may have little ability to challenge them. Businesses may also have commercial reasons to disclose as little as possible.
The contrast with other rights under Part VI is clear. The Act recognises several data subject rights, including rights relating to access, rectification, erasure, portability and objection, subject to the conditions and limitations that apply to each. Meaningful information about automated decisions can help individuals determine which rights may be relevant and how to exercise them. But without meaningful information about an automated decision, they may struggle to know how best to exercise those rights.
The burden will also fall more heavily on people who cannot afford legal advice or who deal with businesses that have little incentive to explain their decisions voluntarily.
For this reason, reform should establish a clear right that applies across sectors. Guidance for particular industries may help regulated businesses, but a right under Part VI would protect everyone affected by automated decisions, regardless of the business involved.
5. THREE FURTHER GAPS
The first gap concerns the word “solely”. Section 37(1) applies to decisions based solely on automated processing, but the Act does not clearly explain what degree of human involvement is sufficient to decide on that category. For example, a staff member may approve a system’s recommendation without having enough time, information, or authority to change it. The article’s concern is that nominal human involvement may weaken the protection in practice. The Commission should clarify what meaningful human review requires, without assuming that every human approval removes a decision from section 37.15
The second gap concerns the contract exception.16 Section 37(2)(a) removes the right in section 37(1) where the automated decision is necessary to enter into or perform a contract between the data subject and the controller. Lending, insurance and tenancy decisions may fall within this exception, but their connection to a contract does not by itself establish that automated decision-making is necessary. The scope of the exception therefore matters greatly. If interpreted broadly, it could exclude some of the decisions that have the most serious effects on individuals. The Commission should clarify how necessity is to be assessed and ensure that the exception is not treated as applying to every decision related to a contract. That is precisely why the missing logic requirement bears on them so heavily.17
The third gap is structural, and it concerns the emerging-technology rules, which are otherwise the strongest part of the framework. Article 43 requires a controller deploying artificial intelligence, the internet of things or blockchain to set technical and organisational parameters covering, among other things, the right against purely automated decisions, safeguards for sensitive data, safeguards for children and other vulnerable groups, and privacy by design.18 Article 43(4) requires an impact assessment covering unequal outcomes and the vulnerability indexes in Schedule 6, testing in low-risk environments, reworking and re-testing, discarding the tool where the risk cannot be managed, and continuous monitoring afterwards.19 This is a serious regime, and nothing here should be read as suggesting otherwise.
But Article 43(3) requires those parameters to be documented and filed with the Commission as part of the Compliance Audit Returns.20 Those returns are filed only by controllers of major importance at Ultra-High and Extra-High Level. Ordinary-High Level entities renew their registration each year and file no returns at all.21 A controller that is not required to file Compliance Audit Returns may still be subject to the substantive duties in Article 43, but its documentation will not reach the Commission through that routine filing process. This creates a potential gap in routine regulatory visibility. The article does not establish that smaller deployers account for the largest number of automated credit decisions, so that broader claim should not be made without supporting evidence.
The point should not be overstated. The substantive duties in Article 43(1), (2) and (4) are not limited by tier. A controller at Ordinary-High Level must still set the parameters, carry out the assessment, test, rework and monitor, whatever its filing position. The absence of routine filing may limit the Commission’s regular visibility of that documentation, although it does not establish that the Commission can never obtain it through other lawful means. The substantive duties remain, but the absence of routine filing may reduce the Commission’s visibility of how some controllers comply with them. That is a narrower complaint than saying small deployers are unregulated, and it is the accurate one.
6. THE COMPARATIVE POSITION
Kenya is close to Nigeria. Section 35 of the Kenyan Data Protection Act 2019 gives a right not to be subject to a decision based solely on automated processing, with exceptions for contract, authorisation by law with suitable safeguards, and consent.22 The structure follows the same model, and the Kenyan Act does not expressly give a right to the underlying logic either. Nigeria is therefore not an outlier in the region on this point, and this article does not suggest that it is.
South Africa is an instructive comparator because it shows that the requirement to provide information about the logic behind automated processing is not confined to European law. Section 71(1) of the Protection of Personal Information Act 2013 prohibits decisions based solely on automated processing that have legal consequences or substantially affect the person, and section 71(2) provides exceptions. Section 71(3) then sets out what the required measures must contain. The second requirement is that the responsible party give the person enough information about the underlying logic of the automated processing to enable her to make representations.23 The first is an opportunity to make those representations.24
The pairing is the point. South Africa treats the right to be heard and the right to know the logic as two halves of one mechanism, because the first is unusable without the second. Nigeria has enacted the first, in section 37(3)(b) and (c), and not the second. The South African provision shows that a legislature can expressly link the right to make representations with access to information about the underlying logic of an automated decision.
One further element is worth noting. Article 44(3) of the Nigerian Directive already invites controllers to benchmark against global consensus on emerging technologies, and requires them to stop using systems that cannot be operated in line with international human rights law or that pose undue risks to the enjoyment of human rights.25 A framework willing to import that standard is not one for which a disclosure duty of the South African kind would be foreign.
7. REFORM: EXISTING POWERS AND LEGISLATIVE CHANGE
An amendment to the Act would be the clearest way to establish an express and enforceable right to meaningful information about automated decisions. The Commission may also be able to strengthen disclosure requirements through existing regulatory powers, but the scope of those powers must be assessed carefully. The following proposals distinguish measures that may be introduced under the existing framework from the legislative change needed to establish a clear individual right.
The first is section 28(3), which expressly allows the Commission to make regulations or issue directives about data privacy impact assessments, including which kinds of processing and which persons are caught.26 Section 28(3) may provide a basis for requiring data protection impact assessments for defined categories of processing and for specifying what those assessments should contain. Within the limits of that power, the Commission could consider requiring controllers to document the factors relevant to automated decisions and how associated risks are assessed. Whether section 28(3) also authorises a direct duty to provide that information to an affected person would require further legal analysis.
The second is Article 35 of the Directive, which already lists Automated Decision Making and Deployment of Artificial Intelligence among the measures a controller may benchmark against, subject to approval by the Commission case by case.27 The Commission could consider developing a common standard for automated decision-making rather than relying on separate case-by-case benchmarks. Such a standard could improve consistency and make compliance easier to assess. However, its legal effect would depend on the powers under which it is issued and would not, by itself, establish a new statutory right unless the law authorises that result.
The third is the general power in sections 61 and 62 to make regulations and issue directives, codes and guidelines, supported by Article 50 of the Directive.28 Sections 61 and 62 provide additional powers to make regulations and issue directives, codes and guidelines within their lawful scope. The Commission could consider using these powers to clarify the information controllers should provide about automated decisions. However, the extent to which those instruments can establish a new individual right, rather than specify obligations under existing rights and principles, requires careful legal analysis. An amendment to the Act would provide a clearer basis for placing an express right to an explanation within Part VI and linking it to the existing enforcement framework.
Any reform should address four related issues. First, the explanation should give the person enough understandable information to identify possible errors in the data or factors used and to challenge the decision. Second, the rules should protect genuine trade secrets without making the explanation meaningless. Controllers could disclose the main factors considered and their relative importance, where appropriate, without revealing source code or sensitive model parameters. Third, the Commission should clarify what meaningful human involvement requires where a controller relies on human review to distinguish a decision from one based solely on automated processing. Fourth, the Commission should consider how the documentation required under Article 43 can be made available for appropriate regulatory oversight, including where a controller is not required to file Compliance Audit Returns.
The existing requirements for impact assessments and the examination of unequal outcomes may provide useful material for this work. The missing link is a clear standard explaining what information should be made available to the person affected, and the legal basis for requiring it.
The unequal-outcome analysis already required by Article 43(4)(a) and the vulnerability indexes in Schedule 6 supply much of the groundwork.29 What is missing is the link between what the controller must work out internally and what the person affected may be told.
8. CONCLUSION
Nigeria’s law provides safeguards against certain automated decisions but does not clearly establish an individual right to meaningful information about the reasons behind them. This omission may make it harder for people to exercise their rights to be heard and to challenge decisions effectively.
Article 41 of the Directive partly addresses transparency, but it does not clearly establish a standalone right to an explanation of a particular decision. Although existing transparency duties may provide a route to enforcement, the legal position would be clearer if the Act expressly recognised that right.
South Africa provides a useful legislative model by linking the opportunity to make representations with access to information about the underlying logic of automated processing. Sections 28(3), 61 and 62 of the Nigerian Act may support measures to improve disclosure within the limits of the Commission’s powers. However, an amendment to the Act would provide the clearest basis for establishing an express and enforceable individual right to an explanation.
Nigeria already has rules requiring organisations to assess, test and monitor emerging technologies. These measures help manage risks, but they do not necessarily ensure that individuals receive an explanation of decisions affecting them. Supervising algorithms is not enough. People must also have enough information to understand and challenge decisions made about them. An express right to an explanation would help close this gap.
Authors:
| Emmanuel Oluwatomilola OmoleLL.B, B.L, CDPO (IIM) | Taiwo Ayobami MetileluLL.B, B.L |
NOTES
1. Nigeria Data Protection Act, 2023, Act No. 37, Federal Republic of Nigeria Official Gazette No. 119, vol. 110 (1 July 2023) [hereinafter NDPA 2023], s. 37(1).
2. NDPA 2023, s. 27(1)(g).
3. NDPA 2023, s. 34(1)(a)(viii).
4. Regulation (EU) 2016/679 (General Data Protection Regulation) [hereinafter GDPR], arts. 13(2)(f), 14(2)(g) and 15(1)(h), each of which requires the controller to provide, in addition to the existence of automated decision-making and the significance and envisaged consequences of the processing, “meaningful information about the logic involved”.
5. NDPA 2023, s. 65, defining “automated decision-making” as a decision based solely on automated processing by automated means, without any human involvement.
6. NDPA 2023, s. 37(2)(a)–(c).
7. NDPA 2023, s. 37(3)(a)–(c).
8. GDPR, art. 22(3), which confines the safeguards it prescribes to the cases in art. 22(2)(a) and (c). Section 37(3) of the Nigerian Act carries no equivalent limitation, with the result that the safeguards apply across all three exceptions.
9. The omission is consistent across both the notification duty and the access right, which makes inadvertence a less plausible explanation than choice. The authors advance no view as to the reason.
10. NDPA 2023, s. 24(3), which imposes a duty of care in respect of data processing and requires demonstrable accountability notwithstanding anything to the contrary in the Act or any other law.
11. Nigeria Data Protection Commission, Nigeria Data Protection Act General Application and Implementation Directive, 2025, NDPC/NDP ACT-GAID/01/2025 (20 March 2025) [hereinafter GAID 2025], art. 41(2)(c)(ii), requiring disclosure of the capabilities of the technology used for processing, particularly the use of algorithms for profiling, the risks involved and their mitigation.
12. GAID 2025, art. 41, headed “Data Ethics, Privacy and Dignity of the Human Person”. Article 41(2)(a) provides that processing shall not only be transparent but shall be seen to be transparent through accountability, and art. 41(2)(d) that a controller who neglects to be demonstrably transparent may be acting in violation of the principle of transparency under the Act.
13. NDPA 2023, s. 46(1), under which a data subject aggrieved by a decision, action or inaction in violation of the Act or subsidiary legislation may lodge a complaint; and s. 51, under which a data subject who suffers injury, loss or harm as a result of a violation may recover damages in civil proceedings.
14. NDPA 2023, s. 24(1)(a), which requires processing in a fair, lawful and transparent manner. The argument that art. 41 is enforceable through s. 24(1)(a) is available but indirect: it converts a specific disclosure obligation into an aspect of a general principle, which is a weaker footing than a right expressed as such.
15. NDPA 2023, s. 65, definition of “automated decision-making”, and s. 37(1), each turning on the decision being based “solely” on automated processing. Neither the Act nor the Directive addresses what degree of human involvement displaces that description.
16. NDPA 2023, s. 37(2)(a).
17. NDPA 2023, s. 25(1)(b)(i), under which processing necessary for the performance of a contract, or to take steps at the data subject’s request prior to entering into a contract, is lawful.
18. GAID 2025, art. 43(1) and (2)(a)–(f), requiring a controller deploying artificial intelligence, the internet of things or blockchain to set technical and organisational parameters addressing the right against solely automated decisions, the right to be forgotten, safeguards for sensitive personal data, safeguards for child rights and other vulnerable groups, cross-border data flows, and privacy by design and by default.
19. GAID 2025, art. 43(4)(a)–(e), requiring a data privacy impact assessment addressing disparate outcomes and the Data Subject’s Vulnerability Indexes in Schedule 6, testing in low-risk environments, retooling and re-testing, discarding the tool where risk is unmitigable, and continuous monitoring where deployment proceeds.
20. GAID 2025, art. 43(3), which requires the technical and organisational parameters to be documented and filed with the Commission as part of the NDP Act Compliance Audit Returns.
21. GAID 2025, art. 7(c), which confines the filing of Compliance Audit Returns to controllers and processors of major importance at Ultra-High and Extra-High Level; and art. 9(3), under which Ordinary-High Level entities renew registration annually without filing such returns.
22. Data Protection Act, No. 24 of 2019 (Kenya), s. 35, conferring a right not to be subject to a decision based solely on automated processing, subject to exceptions for contract, authorisation by law with suitable safeguards, and consent. The structure closely follows both GDPR art. 22 and NDPA 2023, s. 37.
23. Protection of Personal Information Act 4 of 2013 (South Africa), s. 71(3)(b), which requires that the appropriate measures provide the data subject with sufficient information about the underlying logic of the automated processing to enable the data subject to make representations. See also s. 71(1)–(2), on the prohibition and its exceptions.
24. Protection of Personal Information Act 4 of 2013 (South Africa), s. 71(3)(a), providing an opportunity for the data subject to make representations about the decision.
25. GAID 2025, art. 44(3), under which a controller may benchmark against global consensus on emerging technologies such as the United Nations Resolution on Artificial Intelligence, and shall refrain from or cease the use of systems impossible to operate in compliance with international human rights law or posing undue risks to the enjoyment of human rights.
26. NDPA 2023, s. 28(3), by which the Commission may make regulations or issue directives with regard to data privacy impact assessments, including the categories of processing and persons subject to the requirement.
27. GAID 2025, art. 35(6)(b) and (g), which list Automated Decision Making and Deployment of Artificial Intelligence among the Interoperable Data Privacy Measures against which a controller may benchmark, subject to the Commission’s approval under art. 35(4)–(5).
28. NDPA 2023, s. 61(1) and (2)(b), on regulations for the protection of personal data and data subjects; s. 62, on directives, codes and guidelines; and GAID 2025, art. 50, on supplementary instruments.
29. GAID 2025, art. 43(4)(a)(i) and sched. 6, on disparate outcomes and the Data Subject’s Vulnerability Indexes.
This update has been prepared by the Data Protection and Privacy team at Omole, Komolafe and Partners.
DISCLAIMER: This article is intended for information purposes only and does not constitute legal advice. It does not create, and shall not be construed as creating, a client/attorney relationship between readers and the firm or any author. Specific legal advice should be sought in relation to particular circumstances.
