If your business collects, stores, or processes personal data in Nigeria customer records, employee files, financial data, or even a simple mailing list, you are legally required to register with the Nigeria Data Protection Commission. This guide walks you through everything you need to know: the registration tiers, the documents and information required, and the step-by-step process for NDPC registration in Nigeria.
What Is the NDPC and Why Does Registration Matter?
The Nigeria Data Protection Commission (NDPC) is the independent federal agency established under the Nigeria Data Protection Act 2023 (NDPA 2023) to regulate the processing of personal data in Nigeria and to protect the privacy rights of Nigerian citizens.
Before the NDPA 2023, Nigeria’s data protection framework was governed by the Nigeria Data Protection Regulation (NDPR) 2019, a regulation issued by the National Information Technology Development Agency (NITDA). The NDPA 2023 replaced and substantially upgraded that framework, creating a dedicated statutory commission with broader powers, clearer obligations, and real enforcement teeth.
In September 2025, the NDPC issued the General Application and Implementation Directive (GAID 2025) a comprehensive directive that operationalises the NDPA 2023 and introduces specific timelines, procedures, and standards that all organisations processing personal data in Nigeria must now follow.
Why Registration Is Non-Negotiable?
Registration with the NDPC is not optional for businesses that qualify. The NDPA 2023 requires every Data Controller and Data Processor of Major Importance (DCPMI) to register with the NDPC, pay the applicable registration fee, and maintain that registration on an annual basis.
Failure to register does not mean the obligations do not apply; it simply means you are in breach of them. And the NDPC has demonstrated clearly that it intends to enforce compliance. In August 2025, it issued compliance notices to 1,368 organisations across banking, insurance, pension, and gaming sectors. In May 2025, it fined MultiChoice Nigeria, the company behind DStv and GOtv, ₦766 million for privacy violations.
The NDPC is not waiting politely. If your business processes personal data and has not registered, you are already in breach, and late penalties apply.
Who is a Data Controller or a Data Processor?
Before you can register, you need to understand which category your organisation falls into. The NDPA 2023 draws a clear distinction between two types of organisations.
Data Controller
A Data Controller is any person, organisation, or public authority that, alone or jointly with others, determines the purposes and means of processing personal data. In plain terms: if your organisation decides why and how personal data is collected and used, you are a Data Controller.
Examples of Data Controllers:
- A bank that collects customer account data
- A hospital that maintains patient medical records
- An e-commerce platform that stores customer purchase history
- An employer that processes employee payroll and HR data
- A fintech company that collects borrower information for loan assessment
- A school that holds student and parent records
Data Processor
A Data Processor is any person, organisation, or public authority that processes personal data on behalf of a Data Controller. The Data Processor acts on instructions it does not decide the purpose or the means of processing.
Examples of Data Processors:
- A payroll software company that processes employee data on behalf of an employer
- A cloud storage provider that stores data on behalf of a client organisation
- A marketing agency that manages a client’s email subscriber list
- A call centre that handles customer data on behalf of a brand
Why the Distinction Matters
Data Controllers and Data Processors have different though overlapping registration and compliance obligations under the NDPA 2023. A single organisation can be both a Data Controller and a Data Processor simultaneously for example, a fintech company that processes its own customer data (Controller) and also processes payment data on behalf of a merchant partner (Processor).
Understanding your category is the first step, because it determines your registration tier, your fee, and the full scope of your ongoing compliance obligations.
The Three NDPC Registration Tiers
The NDPC registers organisations across three tiers based on the nature, scale, and sensitivity of their data processing activities. Only organisations that qualify as Data Controllers or Processors of Major Importance (DCPMI) are required to register. The GAID 2025 defines three DCPMI levels.
Tier 1 – Ultra-High Level (UHL)
Who qualifies:
- Commercial banks, mortgage banks operating at scale, and payment service providers
- Telecommunications companies
- Insurance companies
- Multinational corporations operating in Nigeria
- Social media platform developers and operators
- Oil and gas companies
- Electricity distribution companies
- Organisations that process the personal data of more than 10,000 data subjects within 6 months
Tier 2 – Extra-High Level (EHL)
Who qualifies:
- Federal, state, and local government Ministries, Departments, and Agencies (MDAs)
- Microfinance banks
- Universities, polytechnics, and other higher educational institutions
- Hospitals and medical centres providing tertiary or secondary care
- Organisations processing the personal data of more than 5,000 but fewer than 10,000 data subjects in 6 months
Tier 3 – Ordinary-High Level (OHL)
Who qualifies:
- Small and medium enterprises (SMEs)
- Primary and secondary schools
- Primary healthcare clinics
- Small hotels (fewer than 50 suites)
- Corporate training providers
- Any organisation that processes the personal data of more than 200 data subjects within 6 months
Quick Self-Assessment
Ask yourself these three questions:
- Does my business collect names, phone numbers, email addresses, financial information, health data, or any other personal information about individuals?
- Does my business process data for more than 200 individuals in 6 months?
- Do I make decisions about how that data is used, or do I process it on someone else’s instructions?
If your answer to questions 1 and 2 is yes, you almost certainly qualify as a DCPMI. Your tier depends on the scale and sensitivity of your processing.
If you are uncertain which tier applies to your organisation, legal advice is worth getting before you register.
Documents and information required for NDPC registration in Nigeria
Before registering with the NDPC, gather the following documents:
- Company incorporation documents
- Details of Data Controller/Processor: NIN, Full name, email, phone number, Contact address, state, and sector (For Individual Data Protector or Controller)
- Data Processing Details e.g. Number of data subjects, Categories of organisations you share data with, list of data processed, etc
- Personal and Qualifying details of Data Protection Officer(s)
- Details of Data Controller/Processor Representatives
- Details of cross-border transfer
- Details of technical and operational safety precautions
- Payment of application fee
A practical note: Appointment of a designated Data Protection Officer is a mandatory requirement for registration with the NDPC. Not every person qualifies as a Data Protection Officer (DPO). A DPO must be trained and certified as one by an institution recognized by the NDPC.
What is the penalty for late registration with the NDPC?
The NDPC imposes late registration penalty fees on top of the standard annual registration cost. The specific penalty amount is assessed based on how long the organisation has been in breach, the tier of the organisation, and the nature of its data processing activities.
For late registration, you must pay an additional 50% of the registration fee as a penalty, in addition to the registration fee.
If your business has not yet registered, the right approach is to register as soon as possible, acknowledge the late registration, and engage a licensed DPO or DPCO to assess your compliance position. Proactive remediation is consistently treated more favourably than continued non-compliance that is discovered during an NDPC investigation sweep.
What Happens After Initial NDPC Registration in Nigeria?
Registration with the NDPC is the beginning of your compliance journey, not the end. After registration, your organisation has the following ongoing obligations under the NDPA 2023 and GAID 2025:
- File Annual Compliance Audit Returns (CAR): Data Controllers and Processors of Major Importance must file an annual Compliance Audit Return with the NDPC by 31 March each year. This must be submitted through a licensed Data Protection Compliance Organisation (DPCO); you cannot file it yourself.
- Observation of Data Subject Rights: You must have a mechanism for receiving and responding to data subject rights requests, including rights of access, rectification, erasure, and portability, within 30 days.
- 72-Hour Breach Notification: In the event of a data breach, you must notify the NDPC within 72 hours of becoming aware of it.
- Privacy Policy Maintenance: Your privacy policy must be kept current, accurate, and updated whenever your data processing activities change.
Conclusion
At Lex-Praxis Solicitors, we provide end-to-end NDPC compliance support for Nigerian businesses from initial registration through ongoing compliance management. Our data protection services include:
- NDPC registration: Identifying your correct tier, preparing your documentation, and managing your portal submission
- Data mapping and lawful basis assessment: Documenting your processing activities and identifying the correct legal basis for each
- Privacy policy drafting: NDPA 2023 and GAID 2025-compliant policies tailored to your business, not generic templates
- DPO arrangement: Outsourced Data Protection Officer services for organisations that do not require a full-time internal DPO
- Breach response planning: Preparing your organisation for the 72-hour notification window before any breach occurs
- Late registration remediation: Assessing your penalty exposure and managing your NDPC engagement where registration deadlines have been missed
For enquiries about NDPC registration in Nigeria, you may contact us through the live chat button or the WhatsApp icon on this page, or send us a message by filling this form, and we’ll respond to you.
