Data Privacy & Protection
NDPC Compliance Audit Return preparation and filing, DPO-as-a-service, NDPA gap assessments, DPIAs and staff training.
Book a consultation →Registered with the NDPC (Reg. ID NDPC/DCP/15479) · Nigeria
Prepare and file your CAR
by 31 March.
We prepare your Compliance Audit Return and manage its filing with the NDPC through licensed DPCO professionals, close the gaps that would fail it, and keep your evidence in one place, so you are ready before the deadline, not after.
—days to the 2027 CAR deadlineDeadline: 31 March 2027
Registered with the NDPC (Reg. ID NDPC/DCP/15479)CAR preparation & filingEvidence-led preparation
SP / WORKSPACELive demo
Example Broker Ltd.
Your next review.
A clearer working record.
Preparation tasks4 of 6
Reviewer questions02
Processing records03
THE PREPARATION TRAIL
DPO appointment recordOwner · Governance team
DocumentedVendor processing agreementOwner · Operations team
Review neededREVIEWER COMMENT
Confirm the agreement covers sub-processors and the return or deletion of client data.
Record → evidence → professional review
Sample records only. Explore the interactive demonstration below.
Designed around real responsibilitiesInsurance brokersMicrofinance banksGrowing companiesDPCO practices
Next annual filing date31 March 2027
Data controllers and processors of major importance file a Compliance Audit Return with the NDPC each year, normally by 31 March. Filing dates and surcharges are set by the Commission and can change — confirm your own obligations using official sources.
See plans and the audit-return timeline →Who must file
Find your NDPC tier.
Controllers and processors of major importance file a Compliance Audit Return each year. Your tier depends on your sector and how many people’s data you hold.
| Tier | Who it covers |
|---|---|
| Ultra-High Level (UHL) | Banks, insurers, fintechs, telecoms, or data on 5,000+ people in 6 months |
| Extra-High Level (EHL) | Microfinance and mortgage banks, schools, hospitals, or data on 1,000–5,000 people |
| Missing the deadline | Fine of ₦10 million or 2% of annual gross revenue, whichever is greater |
Not sure of your tier? Take the free readiness check →
How it works
Four steps to a filed CAR.
We handle the preparation and manage the filing end to end, and hand you the evidence.
01 / ASSESSMENT CALL
Assessment call
We confirm your tier, scope and deadline.
02 / DOCUMENTS
We collect your documents
You share what you have; we list what is missing.
03 / PREPARE
We prepare and review your CAR
A practice registered with the Nigeria Data Protection Commission (Reg. ID NDPC/DCP/15479) prepares and checks the return.
04 / FILE
We manage the filing with the NDPC
We manage the filing and hand you the evidence pack.
Our services
Four services.
One accountable team.
Every service line is available now. Start with a short consultation and we confirm the scope in writing.
Management Systems (ISO/IEC 27001, ISO/IEC 27701)
Management-system implementation, gap analysis and internal audit support.
Book a consultation →AI Governance
An AI governance framework and assessment aligned to emerging Nigerian and international expectations.
Book a consultation →Governance, Risk & Compliance (GRC)
A GRC programme that connects privacy, security and risk obligations in one place.
Book a consultation →Serving Nigerians from abroad? See what applies to you.
Sample workspace
See how we keep your evidence organised.
Explore sample records, complete preparation tasks and download a sample pack. This demo uses illustrative data only.
Your preparation overview
Example Broker Ltd. · Sample annual review
4 / 6Preparation tasks completed
3Sample processing activities
2Reviewer questions
What needs attention
Confirm the vendor agreement and add evidence of your latest security assessment before professional review.
Task completion measures this demo checklist only. It does not establish legal compliance or readiness for filing.
Processing records
Sample inventory · three example activities
| Activity | People | Review status |
|---|---|---|
| Policy administration | Customers | Recorded |
| Claims coordination | Claimants | Review basis |
| Staff administration | Employees | Recorded |
A real processing record should document purposes, lawful basis, data categories, recipients, retention and applicable transfers. The example is abbreviated.
Evidence trail
Sample record metadata · no documents uploaded
Governance / sample record
DPO appointment record
Owner: Governance team · Version: 1.0
Documented in exampleInspect the review context
Review the appointment scope, reporting line, responsibilities and current contact details. This example contains no actual appointment document.
Vendor / outstanding evidence
Processing agreement
Owner: Operations team · Version: Not supplied
Evidence requestedInspect the reviewer question
Supply the current agreement and confirm instructions, confidentiality, sub-processors and exit arrangements. Record the agreement version and reviewer decision.
Security / outstanding evidence
Assessment & remediation record
Owner: IT team · Assessment date: Not supplied
Evidence requestedInspect the evidence needed
Provide the authorised scope, assessment date, findings and remediation record. A technical assessment supports its defined scope and does not establish overall compliance.
Preparation tasks
Try checking an item. Progress updates immediately.
Professional review
Illustrative reviewer questions · no actual DPCO assigned
Vendor agreements
Does your processor agreement cover instructions, confidentiality, sub-processors and deletion or return of data?
Does your processor agreement cover instructions, confidentiality, sub-processors and deletion or return of data?
Security evidence
Attach dated evidence of access reviews, backup checks and remediation. A policy alone does not prove that a control operates.
Attach dated evidence of access reviews, backup checks and remediation. A policy alone does not prove that a control operates.
The downloadable pack is a demo summary, not an official CAR or verification statement.
Start with what you know
What needs attention
in your privacy work?
Five questions produce a preparation checklist you can take to your DPO or licensed DPCO.
No email required. This check does not determine your NDPC tier, certify compliance or replace an audit. Answers stay in your browser unless you ask us to email you the checklist.
Trust through transparency
Clear about the company.
Clear about the product.
Supreme Integrated Technologies Nigeria Limited is the company behind this website and its professional service offering.
Registered with the NDPC
Supreme Integrated Technologies Nigeria Limited is registered with the Nigeria Data Protection Commission (Reg. ID NDPC/DCP/15479).
Our team includes NDPC-licensed data protection professionals. Licence details are available to clients on request.
A working workspace
Try the local readiness check and sample workspace. Production accounts, document uploads and paid subscriptions open in stages.
Evidence with context
Security assessments can support a review when authorised and scoped. A scan or completed checklist does not establish overall legal compliance.
Does software include an official audit or filing?
Software access and professional services are separately scoped. Supreme’s DPCO team can be engaged for an assessment and applicable filing support. The demonstration is not an official CAR or audit opinion.
Can we keep our existing DPO or DPCO?
The workspace is designed for company-authorised adviser access. Your organisation chooses its adviser and the permissions relevant to its engagement.
Can we start with professional support?
Yes. Book a CAR assessment and we will confirm the service and scope you need.
What does the sample workspace save?
Sample task selections stay in page memory only while the page is open. Nothing is stored on your device, and no client documents are uploaded. Use Reset to return the sample tasks to their starting state.
Work with Supreme
Make your next step clear.
Prepare a short brief for a conversation about your organisation’s needs.