Understanding The New Data Protection Compliance Audit Regime In Nigeria

Introduction

One of the key compliance mechanisms introduced under the NDPA is the requirement for certain data controllers and data processors to conduct periodic compliance audits and file Compliance Audit Returns (CAR) with the Nigeria Data Protection Commission (NDPC).

This article provides an overview of the new data protection compliance audit regime in Nigeria, with particular focus on the obligations surrounding the filing of Compliance Audit Returns. We examine who qualifies as a Data Controller or Data Processor of Major Importance, the timelines and penalties associated with CAR filings, the classification framework established by the NDPC, applicable exemptions, statutory filing fees, and practical steps organizations can take to achieve compliance.