Data protection audit returns and the NDPC’s enforcement turn

Who the Act catches

Section 2 of the Nigeria Data Protection Act 2023 applies the Act where the controller or processor is domiciled, resident or operating in Nigeria, where the processing occurs in Nigeria, or where a foreign controller processes the personal data of data subjects in Nigeria. Article 8(2) of the General Application and Implementation Directive reads “operating in Nigeria” to include an entity that targets a data subject in Nigeria without being established here. That is the hook for offshore platforms and foreign service providers.

The Directive itself took effect on 19 September 2025, six months after issue, and Article 3(3) records that the Commission ceased to apply the Nigeria Data Protection Regulation 2019 as a regulatory instrument. Any compliance programme still written in NDPR language needs remapping.

Major importance, and the 200-person line

Only controllers and processors “of major importance” must register. Section 65 defines the class by reference to the number of data subjects the Commission prescribes, or by processing data of particular value or significance to the economy, society or security of Nigeria.

The Directive divides the class into three tiers. The general entry point is processing the personal data of more than 200 data subjects within six months. Above that, the tiers turn on volume, with the ordinary tier running from 200 to under 1,000, a middle tier to just under 5,000, and the highest tier above roughly 5,000 and sweeping in banks, telecommunications operators, insurers, payment providers, fintechs and multinationals by sector regardless of count. Additional independent limbs catch fiduciaries and service providers in listed sectors including finance, health, education, aviation, oil and gas and electric power.

Two hundred people is a low bar. A medium-sized employer with a customer list will clear it without thinking about it.

Registration

Section 44 requires registration within six months of becoming a controller or processor of major importance. The Commission’s one-off window in 2024 has long closed; what governs now is the six-month clock from the date an organisation crosses a threshold, and a duty to notify material changes within 60 days.

Registration fees run by tier, from a nominal sum at the ordinary level to substantially more at the highest. The upper two tiers register once and then file an annual return; the ordinary tier renews registration annually instead and files no return.

The Compliance Audit Return

Organisations in the upper two tiers file a Compliance Audit Return on or before 31 March each year. An organisation established after the Act commenced files within 15 months of establishment and annually thereafter. Filing is through the Commission’s portal and must be made through a Data Protection Compliance Organisation licensed under section 33 — by January 2026 there were over 300 of them.

The return is not a form-filling exercise. It covers privacy notices, categories of data processed, the lawful bases relied on, whether a data protection impact assessment was required and carried out, legitimate interest assessments, how data subject rights are exercised in practice, complaints and remediation, security measures, the grounds relied on for cross-border transfers, and breach notifications.

Filing fees were introduced for the 2026 cycle, having previously been nil, and run into seven figures for the largest filers. Late filing attracts the fee plus an administrative penalty of 50% of it. The 2025 return deadline was extended once, from 31 March to 30 May 2026; absent a further extension the 2026 return falls due on 31 March 2027.

The data protection officer

Section 32 requires a controller of major importance to designate a data protection officer with expert knowledge. The Directive puts real content into the role: contact details published and notified to the Commission; active engagement on all processing questions; resources, access and continuous training; freedom from duress, coercion or covert influence; protection from dismissal or penalty for performing the role; a direct reporting line to management; and a semi-annual internal report which forms part of the record of processing activities and is verified by the DPCO at audit. In June 2026 the Commission added a continuing professional development framework that certified officers must satisfy to retain active status.

Enforcement is now real

The Commission spent its first period building a register. It is now issuing penalties. Fidelity Bank was penalised ₦555.8 million in August 2024 for processing without consent and non-compliant third-party engagement. MultiChoice Nigeria was penalised ₦766.2 million in July 2025 for breaches including unlawful cross-border transfer and collection of data from non-subscribers. A penalty of US$32.8 million against Meta in February 2025 was compromised by consent judgment in November 2025, a settlement now itself under challenge in the Federal High Court.

In August 2025 the Commission published notice to more than 1,300 firms — microfinance banks, insurance brokers, insurers, pension administrators and gaming operators — requiring evidence of return filing, officer designation, safeguards and registration within 21 days. By January 2026 it reported 246 concluded investigations and 11 cases resulting in fines and remediation directives.

Section 48 sets the exposure for an organisation of major importance at the greater of ₦10,000,000 or 2% of annual gross revenue in the preceding year, with half those figures for others, alongside remedial orders, compensation to data subjects and accounts of profits.