CevroNigeria NDPA compliance checklist for companies
The Nigeria Data Protection Act (NDPA) 2023 is regulated by the Nigeria Data Protection Commission (NDPC). It applies to organizations that process the personal data of people in Nigeria, including companies based elsewhere. Use this checklist to see where you stand.
1. Work out whether you are a major controller or processor
Registration and officer duties kick in once a controller or processor crosses the threshold for a Data Controller or Processor of Major Importance (DCPMI). Confirm your status against the NDPC's criteria and revisit it as you grow.
2. Register and appoint a data protection officer where required
If you are a DCPMI, register with the NDPC and designate a data protection officer. Record who holds the role and keep the registration current.
3. File the annual compliance audit return
A DCPMI must submit an annual Compliance Audit Return. Keep your records, policies and evidence organized through the year so the return is a summary, not a project.
4. Be ready to notify a breach within 72 hours
The Act sets a 72-hour window for notifying the regulator of a qualifying personal data breach. You need detection, a clear incident owner and a template for the notice.
5. Assess risk with a data protection impact assessment
Run a DPIA before high-risk processing and keep the result on file.
6. Control cross-border transfers
Transfers of personal data out of Nigeria are restricted and need a lawful basis. Document each transfer, the vendor involved and the safeguard relied on.
7. Know the stakes
Penalties can reach 2% of annual gross revenue or ₦10,000,000, whichever is greater, so this is a board-level risk for any company with Nigerian users.
Fintech note
Licensed financial institutions also face separate central bank cybersecurity expectations. Those are sector rules in addition to the NDPA, not a replacement for it.
Frequently asked questions
Does the NDPA apply to foreign companies?
It applies to processing of personal data of people in Nigeria, so foreign companies with Nigerian users can be in scope.
What replaced the NDPR?
The NDPA 2023 is now the principal statute for data protection in Nigeria and the regulator is the NDPC.