The commencement of January 2026 signals the formal start of the
annual Data Protection Compliance Audit cycle under the Nigeria
Data Protection Act, 2023 (“NDPA”). In accordance with
the NDPA and the General Application and Implementation Directive
(“GAID”) issued by the Nigeria Data Protection
Commission (“NDPC”), all Data Controllers and Data
Processors of Major Importance (“DCPMIs”) are required
to conduct a compliance audit and file their Compliance Audit
Returns (“CAR”) with the NDPC no later than 31 March
2026.
The audit requirement is anchored in Section 24(2)(g) of the
NDPA and Article 7 and 10 of the GAID, which empower the NDPC
to:
- Designate certain entities as Data Controllers or Data
Processors of Major Importance based on the nature, volume, and
sensitivity of personal data processed.
