Izini
Everything Izini does →Key facts
| Legal basis | Nigeria Data Protection Act 2023, section 44; GAID 2025 Articles 8 and 9 |
| Detailed rules | NDPC Guidance Notice NDPC/HQ/GN/VOL.03/B/24 of 19 December 2024, reproduced as GAID 2025 Schedule 7 |
| Who registers | Data controllers and processors of major importance (s.44(1)) |
| When | Within six months of the Act's commencement (12 June 2023), or on becoming of major importance (s.44(1)) |
| Tiers and fees | Ultra-High Level (UHL) ₦250,000; Extra-High Level (EHL) ₦100,000; Ordinary-High Level (OHL) ₦10,000 (Schedule 7, para 3) |
| Every year | UHL and EHL file a Compliance Audit Return; OHL renews its registration (GAID Art. 9(2)-(3)) |
| Changes | Notify the NDPC within 60 days of a significant change (s.44(3)) |
Are you a data controller or processor of major importance?
The Act defines one as a controller or processor domiciled, resident in or operating in Nigeria that processes the personal data of more than a number of people in Nigeria set by the NDPC, or that the NDPC designates because the data it processes is of particular value or significance to the economy, society or security of Nigeria (s.65).
The NDPC has set the test in Schedule 7. You are of major importance if you keep or have access to a filing system for personal data, paper or digital, and any one of these applies (para 1):
- you process the personal data of more than 200 data subjects in six months;
- you carry out commercial ICT services on digital devices that belong to other people and can store personal data; or
- you process personal data in one of these sectors: aviation, communication, education, electric power, export and import, financial, health, hospitality, insurance, oil and gas, tourism, e-commerce or public service.
The sector test does not depend on volume. A small school or clinic is of major importance because of its sector, even with fewer than 200 people on file.
Foreign organisations count too. The GAID says "operating in Nigeria" includes targeting data subjects in Nigeria, even if you are not domiciled or resident there (Art. 8(2)).
Who does not register
Schedule 7 says these are not of major importance (para 4):
- traders or artisans who do not pass personal data on, as a trade or business object, to other controllers or processors for their business goals;
- traders with fewer than 15 employees, and artisans who keep no specific filing system of customer data beyond routine phone contacts, receipts, contact addresses and email addresses;
- communities of friends, professionals or people of common interest who interact on social media.
Processing for purely personal or household purposes is outside the designation altogether (para 1(2), NDPA s.3).
The NDPC has also exempted from registration, under section 44(6), these organisations even when they are of major importance (para 6): community-based associations, faith-based organisations, foreign embassies and high commissions, judicial and adjudicatory bodies, and multigovernmental organisations.
Not registering does not mean the law does not apply. The duties in the Act, from lawful basis to breach reporting, apply to every controller and processor. The NDPA guide covers them.
Which tier are you in, and what does it cost?
Schedule 7 places you in a tier in two ways: by naming types of organisation, and by the number of data subjects you process in six months (para 3).
| Tier | Fee | Data subjects in six months | Named types |
|---|---|---|---|
| Ultra-High Level (UHL) | ₦250,000 | Over 5,000 | Commercial banks operating at national or regional level, telecommunication companies, insurance companies, multinational companies, electricity distribution companies, oil and gas companies, public social media and email app developers and proprietors, communication device manufacturers, payment gateway service providers, fintechs |
| Extra-High Level (EHL) | ₦100,000 | Over 1,000 and under 5,000 | Government ministries, departments and agencies, micro finance banks, higher institutions, hospitals providing tertiary or secondary medical services, mortgage banks |
| Ordinary-High Level (OHL) | ₦10,000 | Over 200 and under 1,000 | Primary and secondary schools, corporate training service providers, primary health centres, independent medical laboratories, hotels and guest houses with fewer than 50 suites, processors of sensitive personal data of more than 200 data subjects for commercial purposes |
Schedule 7 also describes each tier by risk factors, such as the sensitivity of the data, financial assets entrusted to you, reliance on cloud services and cross-border data flows, and says any four of a tier's factors are enough to place you in it (para 2).
Where the text does not settle your tier. The bands leave gaps: an organisation with exactly 1,000 or exactly 5,000 data subjects fits none of them, and the notice does not say which tier applies when a named type's volume falls in a different band. Do not guess. Confirm your tier with your DPCO or DPO and keep a note of why.
Other fees to know about
- Data processing fee: a UHL data controller pays ₦5,000 for each processor it engages within 12 months. It does not pay again when it moves that processing to a new processor within 12 months, or for an OHL processor whose registration renewal it pays for (Schedule 7, para 7).
- CAR filing fee: UHL and EHL organisations pay a fee when they file their annual Compliance Audit Return. It depends on the tier and the number of data subjects, as set in GAID Schedule 10 (Art. 10(10)). A late CAR adds an administrative penalty of 50% of the filing fee (Art. 10(9)).
What you submit
You register by notifying the NDPC of (s.44(2)):
- your name and address, and the name and address of your Data Protection Officer;
- a description of the personal data, and the categories and number of data subjects it relates to;
- the purposes for which you process it;
- the categories of recipients you disclose it to, or are likely to;
- the name and address of any processor acting for you, or its representative;
- the countries you transfer personal data to, directly or indirectly;
- a general description of the risks, safeguards and security measures protecting the data; and
- anything else the NDPC requires.
Most of this comes straight from a record of processing activities. If you have one, registration is mostly copying; if you do not, building it is the real work. A controller of major importance must also designate a Data Protection Officer (s.32), so have that decision made before you register. Records of processing in Izini.
After you register
- UHL and EHL: you register once, then file a Compliance Audit Return every year through a DPCO licensed by the NDPC (GAID Art. 9(2), 10(14)): by 31 March if you were established before 12 June 2023, otherwise within 15 months of being set up and then every year (Art. 10(7)-(8)).
- OHL: you renew your registration every year, and do not file a CAR when you renew (Art. 9(3)).
- Changes: notify the NDPC of any significant change within 60 days (s.44(3), Art. 9(4)), through its electronic submission system or, if there is none, by email to the address it provides.
- Leaving the register: if you stop being of major importance you can ask to be removed (s.44(5), Art. 9(5)), but you still owe any outstanding fees (Art. 9(6)).
- The public register: the NDPC publishes the register of organisations that have registered and updates it at least once a year (s.44(4), Art. 9(7)).
What happens if you do not register
Not registering when you are of major importance breaches section 44. After an investigation, the NDPC can make an enforcement order or impose a sanction (s.48(1)), including a penalty of up to the "higher maximum amount" for organisations of major importance: ₦10 million or 2% of the previous year's annual gross revenue, whichever is greater (s.48(3)-(4)). See the fines the NDPC has issued.
NDPC registration checklist
- Check whether you keep a filing system and meet any of the three tests: volume, ICT services or sector
- Check whether you are a named type, and count the data subjects you process in six months
- Work out your tier, and confirm it with your DPCO or DPO if the text does not settle it
- Designate a Data Protection Officer
- Prepare the section 44(2) details from your record of processing
- Register and pay the fee, and keep proof of payment
- Put your next deadline in the calendar: the CAR for UHL and EHL, renewal for OHL
- Set a reminder to report significant changes within 60 days
Izini's Fees and payments module works out your NDPC registration tier and fees and keeps proof of payment with your filing. How Izini handles fees, filings and the CAR.
Questions
Does a small business need to register with the NDPC?
Size alone does not decide it. If you keep or have access to a filing system for personal data and you process the personal data of more than 200 people in six months, provide commercial ICT services on other people's devices, or work in a listed sector such as education, health, financial services or e-commerce, you are of major importance and must register (GAID 2025 Schedule 7, para 1). Traders with fewer than 15 employees and artisans who keep no specific filing system beyond routine phone contacts, receipts and addresses are not of major importance (para 4). The Act still applies to them; they just do not register.
How much does NDPC registration cost?
The registration fee is ₦250,000 for the Ultra-High Level (UHL), ₦100,000 for the Extra-High Level (EHL) and ₦10,000 for the Ordinary-High Level (OHL) (GAID 2025 Schedule 7, para 3). A UHL data controller also pays a ₦5,000 data processing fee for each processor it engages in a 12-month period (para 7). Filing the annual Compliance Audit Return has its own fee, set in Schedule 10.
Do I register every year?
It depends on your tier. UHL and EHL organisations register once and then file a Compliance Audit Return every year. OHL organisations renew their registration every year and do not file a Compliance Audit Return when they renew (GAID 2025 Art. 9(2)-(3)).
Is NDPC registration the same as filing the CAR?
No. Registration tells the NDPC who you are and what you process (NDPA s.44). The Compliance Audit Return (CAR) is the annual evidence of compliance that UHL and EHL organisations file through a licensed DPCO (GAID 2025 Art. 10(6), 10(14)).
Do foreign companies have to register with the NDPC?
They can. A data controller or processor of major importance is one domiciled, resident in or operating in Nigeria (NDPA s.65), and the GAID says "operating in Nigeria" includes targeting data subjects in Nigeria, even without being domiciled or resident there (GAID 2025 Art. 8(2)). A foreign company that targets people in Nigeria and meets the Schedule 7 criteria should register.
Who is exempt from NDPC registration?
The NDPC has exempted community-based associations, faith-based organisations, foreign embassies and high commissions, judicial establishments and bodies carrying out adjudicatory functions, and multigovernmental organisations (GAID 2025 Schedule 7, para 6, under NDPA s.44(6)).
What if our details change after we register?
Notify the NDPC of any significant change to what you submitted within 60 days of the change (NDPA s.44(3), GAID 2025 Art. 9(4)). If you stop being of major importance, you can ask to be removed from the register, but you still owe any outstanding fees (Art. 9(5)-(6)).