Does your business collect customers’ names, phone numbers, email addresses, payment details, or employee records? If so, you have responsibilities under Nigeria’s data protection laws. However, not every business is automatically required to register with the Nigeria Data Protection Commission (NDPC). Whether registration is mandatory depends on your organisation’s activities and the applicable regulatory requirements.
Understanding these obligations is essential for avoiding compliance gaps, protecting personal information, and maintaining customer trust.
What Is the NDPC, and What Does It Do?
The Nigeria Data Protection Commission (NDPC) is the regulatory authority responsible for overseeing data protection in Nigeria under the Nigeria Data Protection Act (NDPA) 2023.
The Commission promotes the lawful, fair, and accountable processing of personal data and protects individuals’ privacy rights.
Businesses that collect, store, use, or share personal information must understand their obligations under the Act, including requirements relating to data security, transparency, accountability, and individuals’ rights.
Which Businesses Must Register with the NDPC?
Under the NDPA, the NDPC has the authority to designate certain organisations as Data Controllers or Data Processors of Major Importance (DCPMIs). Organisations falling within the applicable designation criteria are required to register with the Commission.
The Commission’s 2025 General Application and Implementation Directive (GAID), including its guidance on registration, provides criteria for determining which organisations qualify.
Your business may fall within the relevant categories if it:
- Processes personal data on a significant scale.
- Operates in a sector specifically identified under the applicable regulatory guidance.
- Provides information and communication technology services involving the processing of personal data.
- Processes personal data considered significant to Nigeria’s economy, society, or security.
The applicable criteria may include the volume and nature of personal data processed, the sector in which an organisation operates, and the significance of its processing activities.
Important: A small business is not automatically exempt simply because of its size. Equally, collecting personal data does not automatically mean that every business must register as a DCPMI. Organisations should assess their activities against the current NDPC requirements.
For the applicable criteria, consult the Commission’s official registration guidance and regulatory resources.
What Happens If Your Business Is Required to Register but Fails to Do So?
Failure to meet applicable NDPC registration requirements may expose an organisation to regulatory enforcement and other consequences under the Nigerian Data Protection Act.
Potential consequences include:
- Regulatory action: The NDPC may investigate suspected non-compliance and take appropriate enforcement measures.
- Financial penalties: Breaches of applicable legal obligations may attract administrative penalties in accordance with the law.
- Reputational damage: Customers and business partners may lose confidence in an organisation that fails to protect personal information.
- Commercial difficulties: Weak compliance practices may complicate contractual relationships, due diligence exercises, and business partnerships.
Registration alone, however, does not establish complete compliance. Businesses must also implement appropriate data protection measures and fulfil their other applicable legal obligations.
What Should Your Business Do to Achieve Compliance?
If you are uncertain about your organisation’s obligations, consider the following steps.
1. Identify the Personal Data You Process
Determine what personal information your organisation collects, why it is collected, where it is stored, who can access it, and whether it is shared with third parties.
2. Assess Your Registration Obligations
Review the current NDPC registration criteria to determine whether your organisation qualifies as a Data Controller or Data Processor of Major Importance and which requirements apply to its category.
3. Conduct a Data Protection Compliance Assessment
Review your privacy notices, data protection policies, security controls, employee practices, vendor agreements, and procedures for responding to data subject requests.
4. Establish Appropriate Safeguards
Implement suitable technical and organisational measures to protect personal information. These may include access controls, staff training, secure storage, retention policies, and procedures for managing data breaches.
5. Seek Professional Guidance
A qualified data protection professional can help assess your organisation’s obligations, identify compliance gaps, and develop a practical plan for meeting applicable requirements.
How Can a Licensed DPCO Help Your Business?
A Data Protection Compliance Organisation (DPCO) is an organisation licensed by the NDPC to provide authorised data protection compliance services.
Depending on its licensed scope, a DPCO may assist with compliance assessments, privacy audits, staff training, policy development, regulatory filings, and data protection advisory services.
Working with a licensed DPCO can help your organisation understand its regulatory obligations and implement a structured approach to data protection.
However, engaging a DPCO does not transfer all legal responsibility away from your business. The organisation remains accountable for fulfilling its own obligations under the law.
Protect Your Business with Hastrup Solicitors
Understanding whether your business must register with the NDPC is an important step towards achieving compliance with the Nigeria Data Protection Act 2023. Taking action early can help reduce regulatory risks, protect customer information, and strengthen your organisation’s reputation.
Hastrup Solicitors, a law firm and NDPC-licensed Data Protection Compliance Organisation (DPCO), provides legal and data protection compliance support to organisations seeking to understand and fulfil their obligations under Nigerian data protection law.
Whether you need help assessing your registration requirements, reviewing your data protection practices, conducting a compliance audit, or developing appropriate policies, professional guidance can help you take the right steps.
Contact Hastrup Solicitors at info@hastrupsolicitors.com to discuss your organisation’s data protection compliance needs and determine the appropriate next steps.
