Guide · Nigeria

NDPA Compliance Checklist for Nigerian SMEs (2026)

Every Nigerian business that holds personal data must have a lawful reason for it, tell people in a privacy notice, keep it secure, report serious breaches to the NDPC within 72 hours, and bind its vendors by contract. If you handle the data of more than 200 people in six months, you must also register with the NDPC (₦10,000 to ₦250,000), appoint a data protection officer and, in the two higher tiers, file an annual audit return by 31 March through an NDPC-licensed DPCO.

Request a free IT policy review WhatsApp us

Last updated 14 October 2026, by the Inventrium (IBSS) team, Lagos

The rules and dates here come from official notices and reputable published summaries. Dates can change, so check the regulator’s own page before you plan around them. This is general guidance, not legal advice. Rules last checked 14 October 2026.

What must an SME do to meet the NDPA? The checklist

The Act came into force on 12 June 2023. The NDPC’s General Application and Implementation Directive (GAID), issued on 20 March 2025 and effective from 19 September 2025, sets out how it applies in practice. Work through these in order. Items 1, 2 and 11 depend on your size. The rest apply to every business that handles personal data.

Register with the NDPC if you are of major importance. Count the people whose data you process in six months. Over 200 puts you in the Ordinary-High tier (₦10,000, renewed yearly), over 1,000 in Extra-High (₦100,000) and over 5,000 in Ultra-High (₦250,000). Some sectors are placed by name. (Act s.44; GAID Art. 8–9, Schedule 7.)
Appoint a data protection officer. Required for businesses of major importance; staff or contracted, with contact details published and sent to the NDPC. (Act s.32; GAID Art. 11.)
Map your data and keep a record. What personal data you hold, where it lives, who can open it, why you have it and how long you keep it. Your DPO reports on it to management twice a year. (GAID Art. 7, 13.)
Choose a lawful basis for each use. Consent, contract, legal obligation, vital interest, public interest or legitimate interest. Where you rely on consent, keep proof it was freely given and can be withdrawn. (Act ss.25–26; GAID Art. 16–26.)
Publish a privacy notice and a cookie notice. Say who you are, why you use the data, who receives it, how long you keep it and how people can use their rights or complain to the NDPC. The cookie notice must let visitors accept or decline, and must be prominent, not tucked into the footer. Copy-pasted notices are among the NDPC’s main enforcement concerns in its 2025 annual report. (Act s.27; GAID Art. 7, 27.)
Do a data privacy impact assessment where the risk is high. New technology, large-scale or sensitive processing needs one before you start. (Act s.28; GAID Art. 28.)
Put security measures in place. Access control, two-step sign-in, encryption, patching, tested backups and a plan for lost devices. (Act s.39; GAID Art. 29.)
Have a breach plan. Tell the NDPC within 72 hours of becoming aware of a breach likely to put people at risk, and tell the people affected immediately if the risk to them is high. (Act s.40; GAID Art. 33.)
Sign data processing agreements with your processors. Payroll, cloud, email and marketing vendors handle your data on your behalf. The contract must bind them to the Act. Check where they store it, because transfers outside Nigeria have their own rules. (Act ss.29, 41–43; GAID Art. 34, 45.)
Train your staff. Within six months of starting business and at least once a year after, with a written schedule. (GAID Art. 7, 30.)
Audit every year, and file the audit return if you must. Every business should review its own practice annually. Ultra-High and Extra-High businesses file a Compliance Audit Return (CAR) by 31 March through an NDPC-licensed Data Protection Compliance Organisation (DPCO). NDPC. (GAID Art. 7, 10, Schedule 10.)

Who files the NDPA audit return, and is Inventrium a DPCO?

The annual Compliance Audit Return is filed through an NDPC-licensed Data Protection Compliance Organisation, unless the NDPC approves otherwise (GAID Art. 10(14)). The NDPC publishes the current list of licensed DPCOs on its services portal.

Inventrium is not a DPCO. We hold no NDPC licence and do not audit or file returns. We build to the NDPA as a standard and help clients meet it on the technical and policy side: the IT policies, security controls and records that your DPCO and your DPO will ask to see. Our own approach is set out in our NDPA/NDPC statement.

What evidence should you keep for each NDPA obligation?

Obligation	Who it applies to	Evidence to keep	Who can help
Register with the NDPC	Businesses of major importance (200+ people’s data in six months, or a named sector)	Registration confirmation; yearly renewal for OHL	You, on the NDPC portal; your DPCO or your lawyer on which tier applies
Data protection officer	Businesses of major importance	Appointment letter, published contact, notice to the NDPC, semi-annual reports	Your lawyer or your DPCO
Data map and records	Every business	Record of processing: data, systems, access, purpose, retention	Inventrium: IT asset and data classification policies
Lawful basis and consent	Every business	Purpose-by-purpose basis; consent records	Your lawyer
Privacy and cookie notice	Every business that collects personal data	Published notice; cookie banner with accept and decline	Your lawyer drafts the wording; Inventrium can put it on your website
Impact assessment (DPIA)	High-risk, large-scale or new-technology processing	DPIA report, signed off before processing starts	Your DPCO or your lawyer; Inventrium supplies the technical description
Security measures	Every business	Access list, two-step sign-in, encryption, patch and backup logs, restore tests	Inventrium: business security and an information security policy
Breach response (72 hours)	Every business	Incident policy, breach log, copy of any NDPC notification	Inventrium: incident policy and technical response; your DPO notifies the NDPC
Processor contracts and transfers abroad	Every business that uses vendors	Signed data processing agreements; vendor list with data locations	Your lawyer for the contract; Inventrium for the IT vendor policy and list
Staff training	Every business	Training schedule, attendance, privacy checklist for staff	Inventrium for IT security awareness; your DPCO for the law
Annual audit and CAR filing	Audit: every business. CAR filing: UHL and EHL	Audit report, filed CAR, filing receipt	Your DPCO (Inventrium is not one)

How much does NDPA registration and filing cost?

Tier	Who is in it	Registration fee	Annual obligation
Ultra-High Level (UHL)	Over 5,000 people’s data in six months; banks, telecoms, insurers, fintechs, payment gateways	₦250,000	File CAR by 31 March (fee ₦500,000–₦1,000,000)
Extra-High Level (EHL)	Over 1,000 people’s data in six months; MDAs, microfinance and mortgage banks, hospitals, higher institutions	₦100,000	File CAR by 31 March (fee ₦100,000–₦250,000)
Ordinary-High Level (OHL)	Over 200 people’s data in six months; schools, hotels under 50 suites, labs, training providers	₦10,000	Renew registration yearly; no CAR

Fees from the NDPC’s GAID 2025, Schedules 7 and 10. A late CAR adds 50% of the filing fee (Art. 10(9)). DPCO audit fees are set by each DPCO and are on top of these. Deadlines can move: for the 2025 return the NDPC extended 31 March 2026 to 30 May 2026, as reported by Pavestones Legal, so check the NDPC portal each year.

What are the penalties under the NDPA?

Section 48 of the Act lets the NDPC order a business to remedy a breach, pay compensation and pay a penalty. For a business of major importance, the penalty can reach the higher of ₦10,000,000 or 2% of its annual gross revenue in the preceding financial year. For other businesses, it is the higher of ₦2,000,000 or 2%.

Where does IT support fit into NDPA work?

Most of the checklist is evidence that your systems are run with care: who has access, how data is backed up, what happens when a laptop goes missing, how a breach is spotted and reported. That is IT work, and it is where we help:

IT policies and documentation. Information security, incident management, backup, acceptable use, data classification and IT vendor policies, written for how you work. Start with a free IT policy readiness review.
Security measures. Two-step sign-in, device security, encrypted and tested backups and remote wipe, through business security or Dedicated IT Support.
Not our job: legal advice, DPO appointments, DPIA sign-off and filing your audit return. Those sit with your lawyer, your DPO and an NDPC-licensed DPCO.

Frequently asked questions

Yes. The Nigeria Data Protection Act 2023 applies to any business that collects or uses personal data in Nigeria, whatever its size: customer lists, staff records, CCTV, website forms. What changes with size is registration. Only data controllers and processors of major importance must register with the NDPC, and the NDPC’s guidance notice says traders with fewer than 15 employees who keep no filing system of customer data beyond routine contacts and receipts are not of major importance.

Under the NDPC’s GAID 2025 (Schedule 7), a business that processes the personal data of more than 200 people within six months is in the Ordinary-High Level (OHL) tier, more than 1,000 is Extra-High Level (EHL), and more than 5,000 is Ultra-High Level (UHL). Some sectors are placed in a tier by name: banks, telecoms, insurers and fintechs are UHL; microfinance banks, hospitals and higher institutions are EHL; schools, hotels and guest houses with fewer than 50 suites and corporate training providers are OHL.

Registration costs ₦10,000 for the Ordinary-High Level tier, ₦100,000 for Extra-High Level and ₦250,000 for Ultra-High Level (GAID 2025, Schedule 7). OHL businesses renew every year. UHL and EHL businesses register once and then file an annual audit return, which carries its own filing fee of ₦100,000 to ₦1,000,000 depending on tier and the number of data subjects (Schedule 10). Filing late adds a penalty of 50% of the filing fee.

For UHL and EHL businesses established before 12 June 2023, the Compliance Audit Return (CAR) is due by 31 March every year. A business established after that date files within 15 months of being set up, then every year. The return is filed through a Data Protection Compliance Organisation (DPCO) that is NDPC-licensed. OHL businesses do not file a CAR; they renew their registration each year instead.

There is no single “NDPR certificate” to buy. The NDPR 2019 was the earlier regulation. Today the rules come from the Nigeria Data Protection Act 2023 and the NDPC’s GAID 2025. What exists now is registration with the NDPC if you are of major importance, and, for businesses that file an annual audit return, a Compliance Audit Returns Certificate that the NDPC may issue after the return is filed (GAID Article 10(13)). Be wary of anyone selling a certificate without that process behind it.

If you are a data controller of major importance, yes: section 32 of the Act requires one. The GAID (Article 11) lets the DPO be a member of staff or someone engaged on a service contract, and their contact details must be published and sent to the NDPC. Smaller businesses are not required to appoint one, but someone should still own data protection.

Under section 48 of the Act, the NDPC can order a business to remedy a breach, pay compensation and pay a penalty. For a data controller or processor of major importance the penalty can reach the higher of ₦10,000,000 or 2% of annual gross revenue in the preceding financial year; for others, the higher of ₦2,000,000 or 2%.

No. Inventrium is not a DPCO and does not file audit returns. The return must go through an NDPC-licensed DPCO. The NDPC publishes the list of licensed DPCOs on its services portal. We help with the IT side your DPCO will ask to see: IT policies, security measures, backup and incident records.

Sources

Nigeria Data Protection Commission, Nigeria Data Protection Act General Application and Implementation Directive (GAID) 2025, issued 20 March 2025 (Articles 7–11, 13, 28, 30, 33, 34; Schedules 7 and 10): ndpc.gov.ng, checked 14 October 2026
Nigeria Data Protection Act, 2023 (ss.2, 25–29, 32, 39–44, 48), gazetted text published by the NDPC: ndpc.gov.ng, checked 14 October 2026
NDPC register of licensed DPCOs: services.ndpc.gov.ng, checked 14 October 2026
DLA Piper, Data Protection Laws of the World: Nigeria: dlapiperdataprotection.com, checked 14 October 2026
NDPC, Annual Report 2025 (registrations, audit returns filed, enforcement priorities): ndpc.gov.ng, checked 14 October 2026
DLA Piper Privacy Matters, “Nigeria: NDPC issues GAID, key compliance insights”, 3 June 2025 (19 September 2025 effective date): privacymatters.dlapiper.com, checked 14 October 2026
Pavestones Legal on Mondaq, NDPC extension of the 2025 audit return deadline to 30 May 2026, 8 April 2026: mondaq.com, checked 14 October 2026

This guide is general information as of 14 October 2026, not legal advice. Check your own position with a lawyer or an NDPC-licensed DPCO.

Get your IT policies and security ready for your DPCO

Start with a free IT policy readiness review: a written list of what you have, what to update and what you need, in priority order. Based in Lagos, serving all of Nigeria and Ghana.

WhatsApp us Request the free review