NDPC registration for Nigerian private schools
Whether a Nigerian private school is a data controller of major importance under the NDPC's guidance, and what it must register, renew and report.
By Achekam · · 5 min read · For Education businesses in Nigeria
A private school in Ibadan keeps a file on every child: admission forms, birth certificates, immunisation cards, parents' phone numbers and workplaces, fee records, report cards. Most of it sits in a filing cabinet in the admin office, and more of it every year sits in spreadsheets and e-mail. The proprietor has heard about data protection registration but assumes it is for banks and telecoms companies.
Under the Nigeria Data Protection Commission's guidance, schools are named expressly. This article explains how the NDPC decides who is "of major importance", where primary, secondary and higher institutions fall, and what registration commits a school to: renewal or annual returns, a Data Protection Officer, and a short deadline when something goes wrong.
When an organisation is "of major importance"
The NDPC's Guidance Notice designates a data controller or processor as being of major importance in three situations:
- it keeps or has access to a filing system for personal data and processes the personal data of more than 200 data subjects in six months;
- it provides commercial ICT services on other people's devices; or
- it processes personal data in listed sectors, such as financial, health, education, hospitality, insurance, oil and gas and e-commerce.
A school meets the third test by its nature, and many schools meet the first as well: a school with a few classes of learners, each with parents or guardians on file, passes 200 data subjects quickly. The Guidance Notice is dated 19 December 2024 and is reproduced as Schedule 7 of the GAID 2025. Its heading cites the "Nigeria Data Protection Act, 2003", which is a misprint for 2023. The NDPC publishes the Guidance Notice on registration, which sets out who must register, the levels and the fee for each.
Which level a school falls into, and the fee
The Guidance Notice sorts organisations of major importance into levels, each with its own fee. Two matter for education:
| Level | Who the notice lists, among others | Amount payable |
|---|---|---|
| Ordinary-High | Primary and secondary schools, corporate training providers, and organisations processing personal data of over 200 but less than 1,000 data subjects within six months | ₦10,000 |
| Extra-High | Higher institutions, and organisations processing personal data of over 1,000 but less than 5,000 data subjects within six months | ₦100,000 |
So the notice places a primary or secondary school in the Ordinary-High level by name, and a college, polytechnic or university in the Extra-High level. Because the notice also uses data-subject bands, a large secondary school that is unsure which level applies should confirm its position with the NDPC. Fees are as stated at the time of writing.
Annual renewal or Compliance Audit Returns
The General Application and Implementation Directive (GAID) 2025, issued on 20 March 2025, treats the levels differently once registered:
- Ordinary-High controllers and processors renew their registration every year, and need not file an annual Compliance Audit Return when they renew.
- Ultra-High and Extra-High controllers and processors register once and file Compliance Audit Returns annually.
For a primary or secondary school, that means a yearly renewal date to diarise. For a higher institution, it means an annual audit return to plan for. Article 9(4) of the GAID also requires notice to the NDPC of any significant change to registration information within sixty days, such as a change of address or proprietor.
A Data Protection Officer, with published contact details
Under the GAID 2025, a data controller or processor of major importance must designate a Data Protection Officer, publish the DPO's contact details, and communicate them to the NDPC in the prescribed form. The GAID adds that the DPO reports directly to management, and requires a semi-annual data protection report compiled by the DPO and submitted to management.
In a small school, the DPO may well be an existing staff member, such as the bursar or an administrator, rather than a new hire. Whoever it is needs:
- time in their week for the role;
- a contact address parents can find, for example on the school's website and admission forms;
- a direct line to the proprietor or board;
- a calendar reminder for the semi-annual report.
A breach: seventy-two hours to notify
Under the GAID 2025, quoting section 40(2) of the NDP Act, a data controller must notify the NDPC within 72 hours of becoming aware of a personal data breach that is likely to result in a risk to individuals' rights and freedoms, and must notify affected data subjects immediately. Article 33(5) lists what the notice must contain: the circumstances, dates, data involved, a risk assessment, the number of individuals at risk, the steps taken and a contact person.
Prepare a one-page form with exactly those headings now. When a parents' WhatsApp group receives the wrong class's results, or a laptop with admission files goes missing, the DPO fills in the form rather than starting from a blank page.
One store for learners' files, shared by expiring link, with two-factor sign-in
The guidance is about how the school handles personal data day to day as much as about registration. In Achekam, Document Centre gives the school a single folder-based store: you upload files or whole folders, then preview, download, rename, move, tag, archive and search them, and each new version keeps the ones before. Bringing admission forms and fee agreements into named folders, instead of scattered inboxes, makes it easier for the DPO to say where personal data is kept.
When a file must go to someone outside the school, such as an examination body or a parent, it can be shared by e-mailing a personal link with an expiry, an optional one-time code, and download allowed or not. The share can be revoked if it was sent in error.
Sign-in matters too. Users can turn on two-factor sign-in with an authenticator app, and the workspace can require it for all members under Settings, Security & SSO. Require it for every staff member who can open learner or family records. Setting up the school's workspace is covered in setting up a Nigerian or Kenyan business workspace, and VAT on tuition in VAT on tuition fees in Nigeria.
Before the end of this term, confirm the school's level, check whether it is registered and when renewal falls due, and name its Data Protection Officer in writing.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
