Under the NDPA and the GAID, data controllers and data processors of major importance are required to register with the NDPC. A data controller or data processor of major importance is defined in the NDPA as a data controller or data processor that is domiciled, resident in, or operating in Nigeria and processes or intends to process personal data of more than such number of data subjects who are within Nigeria as the NDPC may prescribe, or such other class of data controller or data processor processing personal data of particular value or significance to the economy, society or security of Nigeria, as the NDPC may designate.

Notably, the term “operating in Nigeria” under the GAID includes a data controller or data processor who targets a data subject in Nigeria, even if not domiciled or resident in Nigeria. In exercising its designation powers, the NDPC considers factors including:

• the risks of data processing to data subjects;
• data sovereignty implications;
• the sensitivity of personal data; data-driven financial assets;
• reliance on third-party servers or cloud computing;
• substantial cross-border data flows;
• use of automated filing systems;
• number of data subjects; and
• the need for international certifications.

The GAID further designates as data controllers or processors of major importance any organization that:

• processes personal data of more than 200 data subjects in six months;
• carries out commercial ICT services on any digital device belonging to another individual; or
• processes personal data in the aviation, communication, education, electric power, export/import, financial, health, hospitality, insurance, oil and gas, tourism, e-commerce, or public service sectors.

The GAID classifies data controllers and data processors of major importance into three levels as follows:

Ordinary High level (OHL)

Number of data subjects whose personal data was processed in six-month period: Over 200 but less than 1,000 data subjects in six months.

Also includes (regardless of data subject volume):

• primary and secondary schools;
• corporate training service providers;
• primary health centres;
• independent medical laboratories;
• hotels and guest houses with less than 50 suites;and
• processors of sensitive personal data of more than 200 data subjects for commercial purposes.

Fee payable: N10,000. Registration must be renewed annually. Not required to file annual CAR.

Extra-High Level (EHL)

Number of data subjects whose personal data was processed in six-month period: Over 1000 but less than 5,000 data subjects in six months.

Also includes (regardless of data subject volume):

• Ministries, Departments and Agencies (MDAs) of government;
• microfinance banks; higher institutions;
• hospitals providing tertiary or secondary medical services; and
• mortgage banks.

Fee payable: N100,000. Registers once; required to file annual CAR (through a licensed DPCO) by 31st March each year.

Ultra-High Level (UHL)

Number of data subjects whose personal data was processed in six-month period: Over 5,000 data subjects in six months.

Also includes (regardless of data subject volume):

• commercial banks operating at national or regional level;
• telecommunication companies;
• insurance companies;
• multinational companies;
• electricity distribution companies; oil and gas companies;
• public social media App developers and proprietors;
• public e-mail App developers and proprietors;
• communication device manufacturers;
• payment gateway service providers; and
• fintechs.

Fee payable: N250,000. Registers once; required to file annual CAR (through a licensed DPCO) by 31st March each year.

Data Controllers Not of Major Importance

The GAID also identifies the following as data controllers not of major importance, who are therefore not required to register with the Commission:

• traders or artisans who do not transmit personal data as a trade or business object to other data controllers or processors;
• traders with fewer than 15 employees, or artisans who do not keep any specific filing system of personal data relating to their customers except routine phone contact files, receipts data, contact addresses and electronic mail addresses; and
• a community of friends, professionals or people of common interest who interact on social media platforms.

Notwithstanding their non-registration status, such entities remain subject to the fundamental obligation to respect the privacy of data subjects under the NDPA.

NDPA Compliance Audit Returns (CAR)

The GAID establishes comprehensive provisions for compliance auditing. Every data controller or data processor of major importance must conduct periodic compliance audits of their data processing activities. The following key obligations apply:

• Audits must adopt a risk-based approach covering people, processes, and technologies in the data processing value chain;
• CAR must be filed by the qualifying organizations through an automated platform or portal provided by the NDPC;
• For qualifying organizations established before 12 June 2023, CAR must be filed not later than 31st March each year;
• For qualifying organizations established after 12 June 2023, the first CAR filing is due within fifteen (15) months of establishment, and annually thereafter;
• Failure to file CAR by the due date attracts an administrative penalty of 50% of the stipulated CAR filing fee in addition to the filing fee; and
• the NDPC may issue a Compliance Audit Returns Certificate upon filing.