Who Owns Your AI Data? What African Users and Businesses Need to Know

Every prompt typed into an AI chatbot leaves the user’s device and lands on a server, usually in another country. For a Lagos accountant pasting in client figures, or a Nairobi clinic drafting patient letters, the question of who controls that text afterwards is practical. The answer depends on which tool is used, which plan it is used on, and which country’s law applies.

Ownership is the wrong word, and control is the right one

Data protection law rarely speaks of “owning” data. It speaks of rights. Under the Nigeria Data Protection Act (NDPA), signed in June 2023, individuals keep rights over their personal data, while companies that collect it take on obligations. The practical contest is therefore over who decides how data is used, how long it is kept, and whether it can be pulled back.

The terms of service decide much of that contest. A Stanford study published in late 2025 reviewed the privacy policies of six major US developers and found that all of them use consumer conversations to train their models, with several doing so by default unless the user opts out. The researchers also flagged long retention periods and thin transparency about how conversation data is used.

Consumer accounts and business accounts are treated differently

The split that matters most is between personal and business plans. When Anthropic changed its consumer policy in 2025, it began training on chats unless users opted out and extended retention to five years for those who allowed it. Business, education and API customers were left outside the change, a pattern OpenAI follows too.

Paying does not change this on a personal account. A June 2026 comparison of settings noted that ChatGPT, Gemini and Claude all train on consumer chats by default, and a paid consumer plan does not switch that off. Enterprise and API tiers generally default the other way.

That matters in African workplaces, where staff often use free personal accounts for work tasks because company-approved tools are slow to arrive. A sales manager summarising a contract on a personal chatbot account may be handing the contract text to a training pipeline, with no one at the company having approved it.

Opting out also has limits. Settings typically stop future conversations from entering training, but they do not necessarily retract data already used in a completed training run. Deleting a chat is not the same as removing its influence on a model.

Leaks are a separate risk from training

Training is the policy risk. Security failure is the operational one. In February 2026, an AI chat app called Chat & Ask AI exposed more than 300 million messages from about 25 million users, according to reporting on the incident. Third-party apps that wrap popular models and promise convenience often have far weaker safeguards than the providers behind them, and users rarely check who built the wrapper.

What Nigerian law already says

A common assumption is that Nigeria has no rules covering AI and personal data. Lawyers dispute that. Practitioners point out that the NDPA already requires a lawful basis for processing, notice of automated decision-making and profiling, and an impact assessment before high-risk processing, all of which apply when personal data is fed into AI systems.

The regulator is also moving to make that explicit. The Nigeria Data Protection Commission (NDPC) has said it will review the Act to address AI, robotics and big data. In March 2026, it said that compliance audit returns from major data controllers would serve as a benchmark for whether AI is being used responsibly in processing personal data. The same month’s reporting noted the Commission had opened an investigation into Temu over the personal data of roughly 12.7 million Nigerian users.

Nigerian businesses cannot treat a foreign AI vendor as a legal shield. The company that decides to send customer data to an offshore tool usually remains responsible for that decision.

The cross-border problem

Most AI tools process data outside Africa, which brings transfer rules into play. Section 41 of the NDPA restricts moving personal data abroad unless the destination offers adequate protection or another lawful basis applies. Kenya’s Data Protection Act and South Africa’s POPIA set comparable conditions, each requiring either safeguards in the receiving country or the individual’s consent.

Enforcement has teeth. In 2024, the NDPC fined MultiChoice Nigeria about N766 million, partly over unlawful cross-border transfers. The same analysis notes that under the NDPC’s implementation directive, cross-border transfer counts as high-risk processing, which makes an impact assessment mandatory before it begins.

Coverage is uneven across the continent. POPIA applies only to processing within South Africa and, unlike Europe’s GDPR, does not reach foreign operators on its own terms. Academic commentary has argued that it engages poorly with the specific features of AI. The Digital Sovereignty and Fair Data Compensation Bill in Nigeria, still before the National Assembly, would address the question of payment when local data trains foreign models, but it is not law.

What this means in practice

For individuals, the sensible baseline is to check the privacy settings on any AI tool before using it for anything personal, and to avoid entering identity numbers, medical details or financial records into consumer accounts.

For businesses, the lesson is procurement. Business-tier plans that exclude training by default, a written data processing agreement, a documented impact assessment for any tool handling customer data, and a clear internal rule on which tools staff may use cost far less than a regulatory investigation. Smaller firms, which are least likely to have a compliance team, are the ones most likely to skip these steps.

Control over AI data in Africa currently rests on three layers that do not always line up: the vendor’s terms, the user’s plan, and a national law still catching up with the technology. Until the legal layer firms up, users and companies carry more of the responsibility than the marketing around these tools suggests.