Understand the work.
Prepare with purpose.

Data controllers and processors of major importance must file a Compliance Audit Return (CAR) with the Nigeria Data Protection Commission (NDPC). Under the Nigeria Data Protection Act and the General Application and Implementation Directive (GAID) 2025, the return is due each year by 31 March, prepared through a licensed Data Protection Compliance Organisation (DPCO).

• Annual CAR filing deadline: 31 March (GAID 2025).
• Missed deadline: a fine of ₦10 million or 2% of annual gross revenue, whichever is greater.
• Late filing can add up to 50% on the filing fee.

Sourced from the GAID 2025 and public compliance guidance below. Confirm your own deadline using official sources.

Last reviewed: 11 October 2026 · Confirm current requirements with the official NDPC sources linked above.

The NDPC groups organisations by importance based on sector and the volume of personal data they process. Your tier determines your registration and filing obligations and the applicable filing fee.

• Ultra-High Level (UHL): banks, insurers, fintechs, telecoms, or data on 5,000+ people in six months. Filing fee ₦500,000–₦1,000,000.
• Extra-High Level (EHL): microfinance and mortgage banks, schools, hospitals, or data on 1,000–5,000 people. Filing fee ₦100,000–₦250,000.
• Ordinary-High Level (OHL): a lighter annual return for other controllers and processors of major importance.

Sourced from the GAID 2025 and public compliance guidance below.

Last reviewed: 11 October 2026 · Confirm current requirements with the official NDPC sources linked above.

The NDPC expects controllers and processors of major importance to appoint a Data Protection Officer, register where required, file the Compliance Audit Return, and be able to evidence the technical and organisational security measures they apply.

• DPO: a named officer with defined responsibilities.
• Registration: applicable to controllers and processors of major importance.
• CAR: filed each year by 31 March.
• Security: documented, dated evidence of the measures you operate.

Sourced from the GAID 2025 and public compliance guidance below.

Last reviewed: 11 October 2026 · Confirm current requirements with the official NDPC sources linked above.

The Nigeria Data Protection Act (NDPA) covers controllers and processors not domiciled in Nigeria that process personal data of people in Nigeria (NDPA s.2(2)(c); GAID Article 1). If you serve customers or staff in Nigeria, the Act can reach you even with no Nigerian office.

• Registration: controllers and processors of major importance register with the NDPC (GAID Articles 7–9).
• Cross-border transfers: sending Nigerians’ data abroad needs a lawful basis under NDPA Part VIII. The NDPC fined MultiChoice Nigeria ₦766.2 million in July 2025 for an unlawful cross-border transfer.
• Annual filing: the Compliance Audit Return is due each year by 31 March, filed through a licensed DPCO.

Whether each of these applies to you depends on your processing — we assess this.

Last reviewed: 11 October 2026 · Confirm current requirements with the official NDPC sources linked above.