Contractors and consultants that are classified as Data Controllers or Processors of Major Importance (DCPMI) by the Nigeria Data Protection Commission (NDPC) must register with the NDPC. This applies to any entity that collects and processes personal data, such as client information, and meets specific criteria, like processing data for over 200 subjects in six months or operating in certain sectors like finance, health, or education. Registration is done online through the NDPC’s registration portal at services.ndpc.gov.ng.
Who needs to register
- Contractors and consultants that are classified as Data Controllers or Processors of Major Importance (DCPMI).
- Entities that collect and process personal data such as client records, employee information, or patient details.
- Specifically, an organization is considered a DCPMI if it processes the personal data of more than 200 data subjects within a six-month period.
- Organizations in sectors like financial services, health, hospitality, e-commerce, public service, education, and oil and gas are also included.
- Any organization that keeps or has access to a filing system (digital or analogue) for personal data processing.
How to register
- Visit the official NDPC registration portal: services.ndpc.gov.ng.
- Navigate to the “New Registration” or ” or contact a Licensed DPCO for guidance to avoid making a mistake.
- Fill out the online application form with all the required information.
- Upload the necessary supporting documents, which may include a valid form of identification for a director, company registration documents, and privacy policies.
- Pay the non-refundable registration fee. Fees vary depending on the category of registration, such as MDP-UHL (Ultra High Level) or MDP-OHL (Ordinary High Level).
- Submit the application.
Why registration is mandatory
- Legal requirement: It is illegal to process personal data in Nigeria without proper NDPC registration.
- Compliance: Failure to register is an offense and can result in legal penalties, including administrative and criminal sanctions.
- Trust and reputation: Non-compliance can lead to reputational damage and loss of customer trust.
- Continued access: Registration is necessary to avoid penalties and to maintain business operations.
