If your organisation processes personal data in Nigeria, the clock is ticking and running out fast.

January 2026 marked the formal start of the annual Data Protection Compliance Audit cycle under the Nigeria Data Protection Act (NDPA) 2023. All Data Controllers and Data Processors of Major Importance (DCPMIs) are required to conduct a compliance audit and file their Compliance Audit Returns (CAR) with the Nigeria Data Protection Commission (NDPC) no later than March 31, 2026.

Who Does This Apply To?

Under the NDPA and its General Application and Implementation Directive (GAID) 2025, DCPMIs categorised as Ultra-High Level (UHL) and Extra-High Level (EHL) are required to file their Compliance Audit Returns with the NDPC on or before the March 31 deadline. This covers:

• Banks and financial institutions
• Fintechs and payment processors
• Telecoms companies
• Hospitals and healthcare providers
• Insurance and pension fund administrators
• E-commerce platforms
• Any organisation handling large volumes of personal data

What Are the Penalties for Missing the Deadline?

The consequences are serious. Organisations that file after March 31 will pay an additional administrative fee of up to 50% of the applicable filing fee. For non-compliance with the requirements of the data protection law, including annual audit filing, the penalty can reach up to 2% of the defaulting entity’s annual gross revenue in the preceding financial year or ₦10,000,000 whichever is greater and may attract direct regulatory scrutiny of the company’s data processing activities.

It’s More Than Just a Form

The NDPA audit regime is not a mere documentation exercise. The audit assesses substantive compliance with core data protection principles under Section 24 of the NDPA including lawfulness, purpose limitation, data minimisation, security safeguards, accountability, and cross-border data transfer restrictions. Organisations with weak internal data governance structures, undocumented processing activities, or poorly managed third-party relationships face increased regulatory exposure, even where filings are made.

New Rules This Year

The NDPC has introduced a new regulatory regime under the GAID which significantly updates the process and requirements for filing the annual CAR. Eligible organisations are required to comply with the new GAID template and filing process. Filing must also be done through a licensed Data Protection Compliance Organisation (DPCO). Organisations cannot file directly on their own.

How DL Legal Consults Can Help

At DL Legal Consults, we guide organisations through every step of the data protection compliance audit process from assessing your data processing activities and identifying compliance gaps, to facilitating filing your CAR with the NDPC before the March 31 deadline.

Don’t let a missed deadline expose your organisation to multi-million naira penalties and regulatory action.

📞 Contact DL Legal Consults today and let’s get your audit filed before the clock runs out.

📧 info@digitallord.com.ng

DL Legal Consults — Your Trusted Legal Partner for Data Protection Compliance and Corporate Matters.