Share on LinkedInShare on LinkedIn

ARTICLE · 08 APRIL 2026

Regulatory Update: NDPC Extends Data Audit Filing Deadline

Pavestones
Pavestones
Contributor
Pavestones

Pavestones

Pavestones is a client focused, solution driven and commercially savvy law practice, providing...

View firm profile
Explore more from Pavestones

The Nigeria Data Protection Commission (“NDPC”) has announced an extension of the deadline for the filing of the 2025 Data Protection Compliance Audit Returns (“CAR”) from March 31 to May 30, 2026.

NigeriaPrivacy
Seun Timi-Koleolu
Seun Timi-Koleolu
Omodele Fatodu
Omodele Fatodu

The Nigeria Data Protection Commission (“NDPC”) has announced an extension of the deadline for the filing of the 2025 Data Protection Compliance Audit Returns (“CAR”) from March 31 to May 30, 2026. Data Processors and Controllers of Major Importance (“DPCMIs”) are therefore encouraged to utilise this period to ensure that their data protection frameworks are aligned with regulatory expectations and to file their Compliance Audit Returns within the extended timeline.

DPCMIs should note that failure to file within the prescribed timeline will attract regulatory sanctions. In particular, late filing of the CAR is subject to a penalty of 50% of the applicable filing fee, in addition to the risk of further regulatory scrutiny or enforcement action by the NDPC.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

Cross-border Data Transfers And International Compliance: Legal Opportunities In Global Tech Transactions

Nigeria's data protection landscape has fundamentally shifted with the enactment of the Nigeria Data Protection Act 2023 and the General Application and Implementation Directive 2025. This article examines the legal architecture governing cross-border data transfers, identifies critical compliance obligations for international technology transactions, and demonstrates how well-structured data compliance can serve as a competitive advantage in one of Africa's most dynamic digital markets.
NigeriaPrivacy
Gresyndale Legal
Gresyndale Legal
Article

Nigeria's 48-Hour Data Breach Notification Requirement: Regulatory Implications And Comparative Analysis

Nigeria's Internet Code of Practice 2026 introduces a 48-hour breach notification requirement for Internet Access Service Providers, creating a shorter timeline than the Nigeria Data Protection Act 2023 and raising questions about overlapping regulatory obligations. This development reflects a broader global trend toward sector-specific cyber resilience requirements that demand earlier visibility into cyber incidents.
NigeriaPrivacy
Syntegral Legal Practice
Syntegral Legal Practice
Article

CBN’S Data Localisation Directive – Compliance Considerations For Payment System Participants

Nigeria's Central Bank has introduced sweeping data localisation requirements that will fundamentally reshape how payment service providers, banks, and financial institutions handle transaction data. With a January 2027 compliance deadline, these new rules mandate that all payment transaction data generated within Nigeria must be stored and managed locally, raising critical questions about cloud infrastructure, vendor relationships, and operational readiness. This analysis examines the scope of the requirem
NigeriaFinance and Banking
Pavestones
Pavestones
Article

Forex Trading In Nigeria: The Implications Of Sec Proposed Rules On Online Forex Trading For Technology And Platform Providers

Nigeria's Securities and Exchange Commission has proposed comprehensive rules for online Forex trading and Contracts for Difference (CFDs), establishing a regulatory framework that extends beyond brokers to encompass technology and platform providers. The proposed regulations introduce stringent capital requirements, operational standards, and compliance obligations for businesses providing trading infrastructure, raising critical questions about registration, data localization
NigeriaFinance and Banking
Pavestones
Pavestones
Article

Virtual Asset Service Provider (VASP) Licences In Kenya & Nigeria - What You Need To Know

Kenya and Nigeria are formalizing their digital asset markets through Virtual Asset Service Provider (VASP) licensing frameworks. While both countries require regulatory approval for crypto operations, their licensing categories, capital requirements, and compliance expectations differ significantly. Understanding these distinctions is essential for fintech founders and financial institutions seeking to enter or expand in these African markets.
NigeriaTechnology
Pavestones
Pavestones