An accounting firm's own NDPA registration
Whether a Nigerian accounting firm is a data controller of major importance under the NDPA, and what that means for how it handles its clients' data.
By Achekam · · 4 min read · For Accountants & audit firms in Nigeria
Accounting firms spend a lot of time on their clients' compliance and rather less on their own. Data protection is a good example. A Nigerian firm may advise clients on the Nigeria Data Protection Act while holding, in its own files, payroll records for hundreds of client employees, identity documents for directors, bank details for suppliers and the personal tax affairs of business owners.
The question this article answers is whether the firm itself is a data controller of major importance, and what follows if it is: registration, fees for processors, a Data Protection Officer, and the way the firm controls who sees client data and how it is disposed of.
The Act reaches the firm
The NDPC says the Nigeria Data Protection Act, 2023 applies to an organisation domiciled, resident or operating in Nigeria, to processing of personal data within Nigeria, and to an organisation outside Nigeria that processes personal data of a data subject in Nigeria. A Nigerian accounting firm is plainly within it.
The NDPC also explains the controller's basic duty. Under section 29 of the Act, a data controller, the organisation that determines the purpose and manner of processing, must ensure that the methods by which data is collected are strictly in line with the principles of data protection. For the firm's own business, the firm is the controller: it decides what it collects from clients and why.
The designation tests applied to a firm
The NDPC's Guidance Notice of 19 December 2024 designates a data controller or processor as of major importance if it meets any of three tests:
- it keeps or has access to a filing system for personal data and processes the personal data of more than 200 data subjects in six months;
- it provides commercial ICT services on other people's devices;
- it processes personal data in listed sectors, such as financial, health, education, hospitality, insurance, oil and gas and e-commerce.
The first test is the one most firms meet without noticing. A practice running payroll for a handful of clients, or holding staff and director records for its audit and tax clients, can pass the 200 mark well within six months. Whether accounting work also counts as "financial" for the third test is a question to put to the NDPC or an adviser; the first test is usually enough to settle the matter. The NDPC's Guidance Notice on registration sets out the tests in full, though its heading cites the Act as of 2003, a misprint for 2023. The tiers themselves are explained in NDPC registration tiers.
Fees for processors the firm engages
The Guidance Notice also sets a fee that depends on the firm's level. An Ultra-High Level data controller of major importance pays ₦5,000 as a data processing activities fee for each processor it engages within a period of 12 months. No new fee is due within 12 months when the activity moves to another processor, or where the controller pays the processor's registration renewal.
For a firm, processors include the outside services that handle client data on its behalf. Whether the fee applies depends on the level the firm is designated at, so establish the level first, then list the processors.
Appointing a DPO
Under the GAID 2025, a data controller or processor of major importance must designate a Data Protection Officer, publish the DPO's contact details and communicate them to the NDPC in the prescribed form. The GAID adds that the DPO reports directly to management and compiles a semi-annual data protection report for management.
In a smaller firm, the DPO may well be a partner or the practice manager. What matters is that the role is named, the contact published, and the semi-annual report actually written.
Restricting, sharing and disposing of client data in Achekam
Good controls on client data are easier to show when the system records them. In Achekam:
- Partners and administrators can restrict a client, or one engagement, to named people with a reason. A restriction is lifted rather than deleted, with who did what and when recorded. The account manager and the engagement's partner and manager can always open it.
- Staff can share a vault document with a named person by an e-mailed link that can block downloading, require a code and be revoked, and every view and download is recorded.
- A governed record is disposed of only after its retention period has ended and no legal hold applies, with three different people requesting, reviewing and approving, and the disposal certificate keeps proof but not the content.
- Record Governance keeps a log of changes to governed records showing who did what, when and with what result, which can be filtered and checked for an unbroken chain. It needs a specific permission to view, and it covers records under record governance, not every screen.
None of this makes a firm meet the Act on its own. It does give the DPO something concrete to point to when describing how client data is controlled.
Records the firm can show the NDPC
| Obligation | What the firm keeps |
|---|---|
| Designation | Its own assessment against the three tests, with the date |
| Registration | Confirmation of registration with the NDPC |
| DPO | The appointment, the published contact details and the semi-annual reports |
| Processors | A list of processors engaged and any fees paid |
| Access to client data | Restrictions in force, with reasons and history |
| Sharing | Shared documents with their view and download records |
| Disposal | Disposal certificates with the three approvers |
Start with the first row. A firm that has written down why it is, or is not, of major importance has done the hardest part; the rest follows from that answer. For the client-facing side, see whether an accounting firm can file a client's NDPA audit return.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
