Nigeria Data Protection Commission (NDPC) Compliance Audit Returns ("Cars") Alert

The Nigeria Data Protection Commission (NDPC) has issued a Guidance Notice ("Notice") regarding the filing of data protection Compliance Audit Returns ("CARs") for the 2022 cycle. The objective of the Notice is to provide guidance to data controllers and data processors on the filing of annual data protection Compliance Audit Returns with the Nigeria Data Protection Commission. Key points in the Notice are captured hereunder:

a. CARs Filing

The annual filing of CARs is a legal obligation for data controllers under the Nigeria Data Protection Regulation (NDPR) 2019, which was preserved by the Nigeria Data Protection Act (NDP Act) 2023. The NDPR Implementation Framework 2020 extended this obligation to data processors under Article 6.1 of the Framework. Therefore, all data controllers and processors who meet the prescribed minimum thresholds under the NDPR, are required to file CARs with the NDPC on an annual basis on or before March 15 of the following year. The