NDPA, NDPR and cross-border legal documents: what the regulation actually requires
A reading of the Nigerian data-protection position that matters to legal ops teams — which instrument is the primary statute, what a cross-border transfer is, and where an AI review sits in it.
Start with an instrument correction, because a great many vendor pages get it wrong. The Nigeria Data Protection Act 2023 (NDPA) is the primary statute, supervised by the Nigeria Data Protection Commission. The NDPR 2019 has not vanished — it remains relevant as a subsidiary instrument — but a compliance position built on the NDPR alone is built on the older layer.
That distinction matters here because the obligations legal teams care about most — lawful basis, data-subject rights, and the treatment of transfers outside Nigeria — sit in the Act.
Where an AI review becomes a transfer
A contract sent to a model provider hosted outside Nigeria is a cross-border transfer of whatever personal data that contract contains — and commercial agreements contain a great deal of it: signatory names, addresses, bank details, sometimes employee schedules. It does not stop being a transfer because the destination is an API rather than a filing cabinet.
This is why LexCore treats the model lane as a first-class deployment setting rather than an implementation detail. The sovereignty tier runs inference on local models, so contract text never reaches a third-party model provider; the standard lanes do not.
| Question a legal ops review will ask | Where LexCore answers it |
|---|---|
| Is our text used to train a public model? | No — the no-training policy covers uploaded agreements, review outputs and playbook rules |
| Can we keep inference inside Nigeria? | Sovereignty tier: model calls run on local models |
| Can we keep the whole stack inside our own network? | Self-hosted sovereign deployment |
| Can we erase a data subject's records? | Permanent document erasure, and full account/tenant purge |
| What survives an erasure? | Append-only audit log and financial ledgers, by design |
Two boundaries, set independently
The mistake teams make is treating "where the data lives" and "where the model runs" as one switch. They are two, and a defensible position usually sets them differently for different matters: a routine NDA does not need the same lane as a regulator-facing brief. Setting them per matter is cheaper than setting them once, at the strictest level, and then watching people route around the tool.
What to write down
- Which matter types may leave the local lane, decided in advance rather than per upload.
- The lawful basis you are relying on for processing counterparty personal data in review.
- Your erasure route, and the fact that audit entries persist — a data subject request that promises total erasure and then leaves an audit trail is worse than one that explains the carve-out upfront.
None of this is exotic. It is the same record-keeping a firm already does for outsourced document review; the only new thing is that the vendor is a model.
Keep reading
The sovereignty tier: running local inference for banking and government briefs
Hardware, latency and the honest tradeoffs of running the whole stack inside your own network — including the one requirement people try to skip.
The Lawyer Analysis Metric: documenting human supervision in-tenant
Why the audit trail needs to record who approved a finding, who overruled it, and under which supervision policy — and what that record is for.