Compliance Audit Return (CAR): who files, the deadline, the fees and what goes in it

Key facts

Who has to file a CAR?

The GAID says a data controller or processor of major importance files a CAR every year (Art. 10(6)). How that applies depends on your registration tier:

• Ultra-High Level (UHL) and Extra-High Level (EHL): you register once and then file a CAR every year (Art. 9(2)).
• Ordinary-High Level (OHL): you renew your registration every year and are not required to file a CAR when you renew (Art. 9(3)).

Your tier comes from GAID Schedule 7. If you have not worked it out yet, start with the NDPC registration guide, which covers who is of major importance and how the tiers work.

Not of major importance? You do not file a CAR, but the duty to audit still reaches you. Every data controller and processor must carry out periodic compliance audits of its processing, take a risk-based approach across people, processes and technology, set the techniques and frequency of audit for each point of risk (subject to any directive by the Commission), and audit online devices "as frequently as possible" (Art. 10(1)-(5)).

When is the CAR due?

• Established before 12 June 2023: no later than 31 March each year (Art. 10(7)).
• Established after 12 June 2023: no later than 15 months after you were set up, and every year after that (Art. 10(8)).

Where the text does not decide. Article 10(8) does not say whether the later yearly returns fall on the anniversary of your first filing or move to 31 March. It also does not say which rule applies to an organisation established on 12 June 2023 itself, and the GAID does not define "establishment". Confirm the date with your DPCO and keep a note of what you agreed.

What does filing cost?

The filing fee depends on your tier and your number of data subjects (Schedule 10). The Commission can set different fees (Art. 10(10)).

Two gaps in the schedule. EHL band B is printed as "5,000-2,500", so the schedule does not say clearly which band covers an EHL organisation with between 5,000 and 10,000 data subjects. Schedule 10 also does not say over what period the data subjects are counted. Do not guess: confirm your band with your DPCO before you pay.

Late filing. If you miss the deadline you pay the filing fee plus an administrative penalty of 50% of it (Art. 10(9)). A ₦500,000 fee becomes ₦750,000.

The fee your DPCO charges for its audit work is a separate matter between you and the DPCO. The GAID does not set it.

How you file

1. Through a licensed DPCO. UHL and EHL organisations file through a Data Protection Compliance Organisation licensed by the NDPC, except as otherwise approved by the Commission (Art. 10(14)). The Act lets the NDPC license people with the right expertise to monitor, audit and report on compliance (NDPA s.33).
2. On the Commission's portal. The CAR is filed through an automated platform or portal the Commission provides (Art. 10(12)).
3. On the Schedule 2 template, or in any other form the Commission prescribes (Art. 10(6)).
4. After filing, the Commission may ask you, or anyone connected to the processing audited, for more information (Art. 10(11)), and it may issue a Compliance Audit Returns Certificate (Art. 10(13)).

What the CAR asks: the Schedule 2 template

The template opens with your organisation's name, address, phone and email; the names and emails of your DPO and your DPCO; your sector; and your estimated number of data subjects. Most questions are answered yes or no, or by choosing the statements that describe your organisation. It has five parts.

Part 1: People and process (governance)

• Your NDPC registration number.
• Your DPO: whether one is designated, whether staff or a consultant, trained, certified by an accredited body (with the accreditation number), taking part in continuous professional development, and whether they earned the required CPD credit within 12 months.
• Whether you have a schedule of data protection training for everyone who works for you or deals with your data subjects, and whether you deliver it.
• Whether you have a Basic Privacy Checklist of "Dos and Don'ts" for everyone working for or with you, and whether it is annexed to your CAR.
• Statements on your practices: a written schedule for reviewing your processing, procedures that protect data subjects' rights, informed consent, safeguards for children and people without legal capacity, a written policy for routine compliance checks that can happen without notice to employees, pseudonymisation, anonymisation and encryption, and compliance checks when you buy software that collects data.
• How your processing follows the principles of data protection, including limiting data to its purpose, not keeping it longer than needed, keeping it accurate and resolving complaints of inaccuracy quickly (the template names 21 days), and protecting its confidentiality, integrity and availability.
• Your lawful bases for processing, and separately for profiling and marketing.

Part 2: Technology (data security controls and standards)

• Where personal data is held: a central database or server, and any other files or registers, and who can reach them physically and digitally.
• The access controls you use, chosen from a list: personalised passwords, two-factor and multi-factor authentication, encryption at rest and in transit, anti-ransomware, anti-spyware, anti-malware and locational security.
• Whether you have a schedule for monitoring, evaluating and maintaining your data security, and whether a certified data security expert vetted it.
• Whether you have a disaster recovery plan, rated from poor to excellent by how much data you would recover and how fast.
• An overall rating of your data security, from "Poor" to "Industry Grade", measured against standards such as the ISO 27000 series, NIST SP 800 series, the NIST Cyber Security Framework, the CIS Critical Security Controls, COBIT and the HITRUST CSF.

Part 3: Accountability and basic risk evaluation

• Whether you have ever carried out a data privacy impact assessment, whether you deployed new technology in the last year and considered the Act in its design, and whether you process sensitive personal data or target vulnerable data subjects.
• Whether you rely on legitimate interest, and whether you carry out a legitimate interest assessment.
• Whether your DPO prepares the semi-annual data protection report, submits it to management at least once every six months, and whether it is acknowledged and verified by a DPCO.
• Figures: data subject complaints received, under investigation and resolved (and in how many days), NDPC compliance notices and how fast you resolved them, data subject access requests received and resolved, and breaches, with whether you notified the NDPC within 72 hours.

Part 4: Cross-border data transfer

• Whether you transfer personal data outside Nigeria, whether it includes sensitive personal data, and the countries it goes to.
• Your legal ground: an adequacy decision of the Commission, a transfer instrument the Commission approved, or one of the listed grounds such as consent after being told the risks, or a transfer needed for a contract with the data subject (NDPA ss.41-43).
• Whether your transfers are documented and assessed for compliance.

Part 5: Data processors

• Whether you use processors, and whether you have a written contract with each (NDPA s.29).
• Your due diligence: a data processing agreement, ongoing monitoring, confirming the processor is registered with the NDPC as an organisation of major importance, evidence of certifications or standards, secure storage and transfer, involving the processor in your DPIA, and clear incident response protocols.
• Proof of compliance for any sub-processor, obtained from the processor.
• What happens when a processing agreement ends: deletion with confirmation, return of data, anonymisation, audit records and revoking access.

The DPO's semi-annual report

Article 13 of the GAID requires every data controller and processor to have its DPO compile a data protection report every six months and submit it to management (Art. 13(1)). The report goes to an officer authorised to receive the record of processing activities, who acknowledges it, and it forms part of that record (Art. 13(2)-(3)). A DPCO verifies it during the compliance audit (Art. 13(4)), and Part 3 of the CAR asks about it.

The report covers your compliance status, including (Art. 13(5)):

• privacy notices, the types of data you process, and how the principles and lawful bases apply;
• whether you need a DPIA, and any legitimate interest assessment;
• how easily data subjects can exercise their rights, and complaints and how they were resolved;
• notices from the Commission and guidance sought from your DPCO;
• data security, the legal grounds for cross-border transfers, and breach notifications to the Commission and to data subjects.

If your DPO writes these reports through the year, the Part 3 questions on the report and on your complaints, requests and breaches have most of their material ready when the audit starts.

Evidence to prepare before the audit

The template's questions point to these records. Your DPCO may ask for more.

• Your NDPC registration number
• Your DPO's appointment, training, certification, accreditation number and CPD credit
• Your privacy training schedule and proof it was delivered
• Your Basic Privacy Checklist of "Dos and Don'ts", to annex to the CAR
• Your written policy for routine compliance checks
• Your record of processing activities, with the DPO's semi-annual reports and their acknowledgement
• Your DPIAs and legitimate interest assessments
• Your security controls, your monitoring and maintenance schedule and who vetted it, and your disaster recovery plan
• Counts and dates for complaints, access requests, NDPC notices and breaches
• Your cross-border transfer grounds and destination countries
• Your processor contracts, due diligence and termination records

Izini links the records that answer the CAR questions as you keep them, shows a readiness score early, and assembles them into one indexed evidence pack for your DPCO. How Izini handles the CAR.

What filing shows, and what it does not

Registering, filing your annual CAR, and submitting a DPIA or cross-border transfer instruments approved by the Commission show "commitment to accountability and prima facie good faith" (GAID Art. 48(2)). They do not replace concrete evidence if someone complains that you broke another part of the Act (Art. 48(2)).

Article 48(3) says the Commission takes "compliance in terms of accountability" as a partial fulfilment of cooperation, and the degree of cooperation is one of the factors the NDPC weighs when it decides a sanction (NDPA s.48(6)(f)). The Article does not list which duties count.

Questions

Sources

1. Nigeria Data Protection Act, 2023 (Act No. 37), official text, NDPC: sections 6, 29, 33, 41-43 and 48
2. NDP Act General Application and Implementation Directive (GAID) 2025, NDPC: Articles 9, 10, 13 and 48, Schedule 2 (CAR template) and Schedule 10 (CAR filing fees)

This guide is general information about the law as of 31 October 2026. It is not legal advice, and Izini does not replace your DPCO, DPO or lawyer.