- in United States
- within Consumer Protection, Transport and Corporate/Commercial Law topic(s)
- with readers working within the Metals & Mining and Law Firm industries
The commencement of January 2026 signals the formal start of the annual Data Protection Compliance Audit cycle under the Nigeria Data Protection Act, 2023 (“NDPA”). In accordance with the NDPA and the General Application and Implementation Directive (“GAID”) issued by the Nigeria Data Protection Commission (“NDPC”), all Data Controllers and Data Processors of Major Importance (“DCPMIs”) are required to conduct a compliance audit and file their Compliance Audit Returns (“CAR”) with the NDPC no later than 31 March 2026.
The audit requirement is anchored in Section 24(2)(g) of the NDPA and Article 7 and 10 of the GAID, which empower the NDPC to:
- Designate certain entities as Data Controllers or Data Processors of Major Importance based on the nature, volume, and sensitivity of personal data processed.
- Require periodic compliance audits to assess adherence to the data protection principles set out in the NDPA.
- Issue directives, guidelines, and reporting obligations binding on regulated entities.
Failure to comply with these audit and reporting obligations constitutes a breach of the NDPA and exposes organisations to regulatory sanctions.
How Does NDPC Enforcement Affect Your Organisation?
The NDPC has, in recent years, demonstrated a clear shift from advisory regulation to active enforcement. This includes investigations, compliance orders, and administrative penalties across sectors.
- Under Section 48 of the NDPA, administrative penalties for non-compliance may extend to:
- Up to ₦10,000,000, or
- Up to 2% of the organisation's annual gross revenue,whichever is higher, depending on the nature, gravity, and duration of the infringement.
In addition to financial penalties, the NDPC may issue corrective orders, mandate remedial measures, restrict processing activities, or expose defaulting organisations to reputational and commercial risk arising from regulatory action.
Beyond Filing: is your Organization compliant?
It is important to note that the NDPA audit regime is not a mere documentation exercise. The audit assesses substantive compliance with the core data protection principles under Section 24 of the NDPA, including lawfulness, purpose limitation, data minimisation, security safeguards, accountability, and cross-border data transfer restrictions.
Accordingly, organisations with weak internal data governance structures, undocumented processing activities, inadequate security measures, or poorly managed third-party relationships face increased regulatory exposure, even where filings are made.
At Syntegral Legal Practice, we advise and represent organisations through a structured, legally grounded approach to compliance with the Nigeria Data Protection Act and General Application and Implementation Directive. We typically provide support in the following areas:
- Legal evaluation of data processing activities for compliance with statutory and regulatory obligations under the NDPA
- Assessment and review of Data Controller and Data Processor of Major Importance (DCPMI) classification and associated compliance requirements
- Identification and analysis of compliance gaps, enforcement exposure, and potential administrative or civil liability
- Advisory on remedial measures, internal controls, and data governance frameworks in line with regulatory expectations
- Preparation, legal review, and filing of Compliance Audit Returns (CAR) with the NDPC on behalf of clients
- Advisory support on Data Protection Officer (DPO) appointments, role definition, and ongoing obligations
- Development, review, and implementation support for data protection policies, procedures, and documentation
- Design and delivery of NDPA-focused training programmes for management, staff, and Data Protection Officers to strengthen organisational compliance culture and
- Legal support for regulatory engagement, inspections, and correspondence with the NDPC.
With the 31 March 2026 filing deadline approaching, organisations are strongly advised to commence their audit process early to allow adequate time for remediation and accurate reporting. Proactive compliance significantly reduces enforcement risk and positions organisations favourably in the event of regulatory scrutiny.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]