NITDA Cautions Employees Not to Upload Sensitive Data to Public AI Services

Nigeria’s National Information Technology Development Agency (NITDA) has issued a formal warning to employees and organisations about uploading sensitive data to publicly accessible artificial‑intelligence platforms.

The advisory cites heightened risks to data privacy, cybersecurity and overall information security when confidential material is entered into open‑source AI services.

According to NITDA, routine workplace use of AI chatbots and generative‑AI tools can unintentionally expose documents, personal identifiers, financial records or proprietary business information.

Such exposure, the agency warns, may lead to data leaks, unauthorised access, compliance breaches and other security incidents.

Why the advisory matters

The warning arrives as both public and private sectors in Nigeria accelerate AI adoption for productivity gains.

While AI can streamline tasks, the lack of clear usage policies creates a gap where employees may share data without understanding platform ownership.

Public AI services typically retain user inputs to improve model performance, meaning that uploaded files could be stored, analysed and potentially repurposed beyond the original organisation’s control.

NITDA stresses that this data retention practice conflicts with Nigeria’s data‑protection regulations, which require explicit consent and secure handling of personal and commercial information.

In worst‑case scenarios, leaked confidential data could damage competitive advantage, erode customer trust and trigger costly regulatory penalties.

Guidance for organisations

The agency urges companies to develop and disseminate clear internal guidelines governing the use of AI tools.

Employees should be trained to recognise which types of information are classified as sensitive and therefore prohibited from public AI interfaces.

Before interacting with any AI service, users are advised to review the provider’s privacy policy and data‑handling statements.

NITDA recommends that organisations only employ AI platforms that have been vetted for secure, enterprise‑grade data protection.

Where possible, businesses should adopt on‑premise or private‑cloud AI solutions that keep data within the corporate firewall.

The agency also calls for regular audits to ensure that staff comply with the newly established AI usage protocols.

Broader regulatory context

NITDA’s caution mirrors a global trend where regulators are tightening oversight of AI‑driven data processing.

Similar advisories have been issued in the United States, Europe and other African nations, reflecting shared concerns about the intersection of AI convenience and privacy law.

By foregrounding responsible AI practices, NITDA aims to balance innovation benefits with the imperative to safeguard national and commercial information assets.

The agency’s statement also signals to technology vendors that the Nigerian market expects robust data‑security guarantees before large‑scale AI deployments.

As AI tools become more embedded in daily workflows, the line between casual experimentation and regulated data handling continues to blur.

NITDA therefore encourages a shift from mere AI consumption toward building home‑grown, secure AI capabilities tailored to local compliance requirements.

This strategic pivot could stimulate domestic AI development while reducing reliance on foreign platforms that may not meet Nigerian data‑sovereignty standards.

For employees, the advisory translates into a practical reminder: before copying a contract clause into a chatbot, verify that the tool is approved for confidential content.

For senior managers, it underscores the need to allocate resources for AI governance, including policy drafting, staff training and technology vetting.

Overall, the warning seeks to preempt incidents that could tarnish Nigeria’s reputation as an emerging hub for digital innovation.

Why This Matters: Unchecked sharing of confidential data on public AI services could expose Nigerian organisations to costly data breaches and regulatory penalties.