The Nigerian Data Protection Act (NDPA) 2023 and its General
Application and Implementation Directive (GAID) 2025, require data
controllers and data processors of major importance
("DCMIs/DPMIs") to file Compliance Audit Returns (CAR)
with the Nigerian Data Protection Commission (NDPC) no later than
the 31st of March 2026 in respect of their data processing
activities for 2025.
Who should file Compliance Audit Returns
DCMIs/DPMIs categorized as Ultra-High Level (UHL) and Extra-High
Level (EHL) are required to file Compliance Audit Returns (CARs)
with the NDPC on or before the above referenced deadline.
Organizations designated as DCMIs and DPMIs fall into the UHL and
EHL categories based on the following criteria:
