One question shapes an NDPA programme: whether you are a controller or processor of major importance. Under Schedule 7 to the 2025 GAID, processing the personal data of more than 200 data subjects in six months is enough, and a small Nigerian employer crosses that line on headcount alone. Everyone carries the section 24 principles, a lawful basis, the 72-hour breach notification and a recorded basis for transfers out of Nigeria. Major importance adds NDPC registration, a Data Protection Officer and, at the higher levels, annual Compliance Audit Returns, and puts you on the higher section 48 ceiling. Settle that first, then work the duties, then choose tooling that files what the Commission asks for.
4 pages on NDPA, in the order the work happens. Jump to the stage you are at, or read straight through.
Know which duties apply to you, whether you are of major importance, and what the section 48 ceilings put at stake.
Work the obligations off line by line, then judge software on whether it keeps the records, the transfer basis and the breach clock the Commission asks about.
These sit under another subject but bear directly on NDPA.
The free compliance check runs the NDPA gap assessment in about five minutes and gives you a scored report you can take to a board meeting.
14-day free trial · no credit card · unlimited users