- Home
- Business compliance
- NDPC Registration and Data Protection Compliance in Nigeria
NDPC Registration and Data Protection Compliance in Nigeria
Lifehampers helps Nigerian businesses comply with the Nigeria Data Protection Act 2023: NDPC registration in the right tier, privacy documents, staff guidance and preparation for the yearly Compliance Audit Return.
Who Must Register with the NDPC
The Nigeria Data Protection Commission (NDPC) enforces the Nigeria Data Protection Act 2023 and its General Application and Implementation Directive (GAID) 2025. Any business that collects personal data, such as names, phone numbers, emails, health or payment details, must protect it and use it lawfully.
Businesses that process the personal data of 200 or more people within six months are treated as data controllers or processors of major importance and must register with the NDPC every year, in one of three tiers:
- Ordinary High Level (OHL): 200 to 999 people in six months, N10,000 a year
- Extra High Level (EHL): 1,000 to 5,000 people, N100,000 a year
- Ultra High Level (UHL): over 5,000 people or regulated sectors such as banking, telecoms, insurance and health, N250,000 a year
Registration
We confirm your tier from your real data numbers and sector, register you on the NDPC portal, and help you appoint a Data Protection Officer where required.
Privacy Documents
We prepare or update your privacy policy, consent wording, website cookie banner and a simple data inventory showing what you collect, why, where it is stored and who sees it.
Yearly Audit Return
The Compliance Audit Return (CAR) is due every year by 31 March and is filed through a licensed Data Protection Compliance Organisation. We get your records ready and coordinate the filing.
Penalties
Serious breaches can attract fines of up to N10 million or 2% of annual gross revenue, whichever is higher, for organisations of major importance. Late audit returns attract a surcharge. Registering in the wrong tier to save money is risky.
Who Needs This Most
Schools, hospitals and clinics, hotels, online shops, estate firms, fintechs, churches with member databases and anyone sending bulk SMS or email to customer lists.
Questions people often ask
Straight answers to the questions we hear most often.
Does my small business need to register with the NDPC?
If you process the personal data of 200 or more people within six months, yes. That includes customer lists, patient records, student records and marketing contacts.
How much is NDPC registration?
The yearly fee depends on your tier: N10,000 (Ordinary High), N100,000 (Extra High) or N250,000 (Ultra High). Confirm current fees on the NDPC portal before paying.
What is the Compliance Audit Return?
A yearly audit of your data protection practices, due by 31 March and filed through a licensed Data Protection Compliance Organisation (DPCO). Your first return is due within 15 months of starting operations.
Do I need a Data Protection Officer?
Organisations in the higher tiers must appoint one. Even if not required, naming a responsible person makes compliance easier.
Does my website need a privacy policy and cookie banner?
If your website collects personal data or uses analytics or advertising cookies, you should have a clear privacy policy and ask for consent where required. We can set this up as part of our website services.
I send bulk SMS to customers. Does this apply to me?
Yes. Phone numbers are personal data, so you need a lawful basis such as consent, an easy opt-out, and secure storage of your contact lists. See our bulk SMS service.
Get Data Protection Compliant
Lifehampers Global Consults handles NDPC registration, privacy documents and audit preparation alongside your CAC and tax compliance.