Filing NDPA compliance audit returns
When a Nigerian data controller of major importance files its compliance audit return, through a licensed DPCO, with fees by tier and the late penalty.
By Achekam · · 4 min read · For Running a business businesses in Nigeria
Every March, a quiet scramble runs through Nigerian companies that hold large amounts of personal data. Someone in compliance remembers that the data protection audit is due, a compliance organisation has to be found or reminded, and the evidence they ask for is spread across HR, IT, marketing and finance.
The compliance audit return (CAR) is the yearly report a data controller or processor of major importance files with the Nigeria Data Protection Commission (NDPC). This article explains when it is due, why it has to go through a licensed compliance organisation, what it costs, and how to collect the evidence through the year rather than in the last fortnight.
The audit itself: within 15 months, then yearly
Under the NDPC's General Application and Implementation Directive (GAID) 2025, a data controller or data processor is expected to conduct a compliance audit under the Nigeria Data Protection Act within 15 months of commencement of business, and annually thereafter.
The audit is the work; the CAR is the filing that reports it. A business that leaves the audit until the filing deadline has left no time to fix what the audit finds.
When the return is due
The GAID sets the filing date by when the organisation was established:
- Established before 12 June 2023: a data controller or processor of major importance files its compliance audit returns by 31 March each year.
- Established after 12 June 2023: it files within 15 months of its establishment and annually thereafter.
The GAID applies the 31 March filing to ultra-high and extra-high level organisations, and says the CAR is filed on the NDPC's automated portal. Ordinary-high level organisations are treated differently: under the GAID they renew their registration every year and need not file an annual CAR when they renew. Which tier you are in is explained in NDPC registration tiers.
Filing through a licensed DPCO
A business cannot simply complete the return itself and upload it. Under the GAID, ultra-high and extra-high level data controllers and processors must file their compliance audit returns through a Data Protection Compliance Organisation (DPCO) licensed by the NDPC, unless the Commission approves otherwise. The NDPC adds that only licensed DPCOs can provide a competent verification statement on compliance audit returns.
So the DPCO is part of the timetable. Engage one early in the year, agree what evidence they need, and book the review well before the end of March. The NDPC's frequently asked questions explain who the Act applies to and that the annual return is due by 31 March and filed through a licensed DPCO.
Filing fees by tier, and the cost of lateness
Schedule 10 of the GAID sets CAR filing fees by tier and by the number of data subjects. At the time of writing:
| Tier | Data subjects | Filing fee |
|---|---|---|
| Ultra-High, A | 50,000 and above | N1,000,000 |
| Ultra-High, B | 25,000 to 49,999 | N750,000 |
| Ultra-High, C | below 25,000 | N500,000 |
| Extra-High, A | 10,000 and above | N250,000 |
| Extra-High, B | the band between A and C (the range is misprinted in the schedule) | N200,000 |
| Extra-High, C | below 2,500 | N100,000 |
The GAID also sets the cost of filing late. A data controller or processor that fails to file its CAR when due must pay an administrative penalty of 50% of the stipulated filing fee, in addition to the fee itself. For an ultra-high level organisation in band A, that turns the fee into one and a half times its normal amount.
Evidence the DPCO will ask to see
A DPCO verifying your return will want evidence, not assurances. Evidence worth having ready includes your privacy notices, records of what personal data you hold and why, contracts with processors, staff training records, how you handled data subject requests and breaches, and who has access to personal data. Collecting these as you go is far easier than reconstructing them in March.
If your business works in Achekam, three features help with the evidence trail:
- A home for the evidence. Achekam's Document Centre is a folder-based store where a business uploads files or whole folders, tags, searches and archives them, and a new version keeps the earlier ones. A "Data protection" folder with a sub-folder per year keeps policies, training records and incident files together, with their history.
- Sharing with the DPCO. A document can be shared by e-mailing a personal link with an expiry, an optional one-time code and downloading allowed or not, and the share can be revoked. That lets you give the DPCO what it needs for the review, for a limited time, without sending files around by e-mail.
- Who can do what. The workspace can allow or deny what each role may do, and check why a member may or may not act. A list of roles and permissions, reviewed and saved each year, answers the access question directly.
An annual data protection calendar
For an organisation established before 12 June 2023:
- January: confirm your tier and filing fee; engage or re-engage the DPCO.
- February: run the compliance audit; collect evidence into the year's folder.
- Early March: fix what the audit found; DPCO reviews and verifies.
- By 31 March: DPCO files the CAR on the NDPC portal; fee paid.
- April: file the verification and acknowledgement; start next year's folder.
- Through the year: log incidents, requests and processor changes as they happen.
Whether the Act reaches your business at all is the first question; see does the NDPA apply to you.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
