Applicants may begin the registration process even while they are still in the process of applying for and waiting to receive the Audit Trust mark from the Nigerian Data Protection Commission. At the same time, they may also be awaiting the Compliance Audit Report and Privacy Impact Assessment Report from a duly registered Data Protection Compliance Organisation (DPCO). This provision allows applicants to initiate their registration without having to wait for all documentation to be fully completed, thereby potentially speeding up the registration timeline.
This approach acknowledges that obtaining the Audit Trust mark and the associated reports can take some time, and by allowing parallel processing, it reduces delays. However, it also means that applicants must be diligent in ensuring that all required documents are eventually submitted to avoid any compliance issues that could arise from incomplete registration.
Applicants who wish to add additional applications (Apps) to their existing registration or who want to change their registered name are required to obtain and submit specific documentation to support these changes. This requirement ensures that any new additions or changes are properly vetted and comply with data protection regulations.
Specifically, if the Privacy Policy of the new Apps differs from the one that was previously audited, the applicant must submit a new Compliance Audit Report and Privacy Impact Assessment Report from a duly registered Data Protection Compliance Organisation (DPCO). This ensures that any new data handling practices are reviewed and compliant with the Nigerian data protection standards.
On the other hand, if the previously audited Privacy Policy remains the same for the new App, rather than submitting a full new audit report, the applicant can submit a Letter of Confirmation from the DPCO stating that the Privacy Policy has not changed. This simplifies the process in cases where there are no significant changes to data protection practices.
Consequences of not adhering to these requirements can be significant. Failure to submit the necessary reports or letters could lead to rejection or suspension of the registration, preventing the applicant from legally operating or offering services under the FCCPC Lenders Registration. Non-compliance with data protection audits may also result in penalties or sanctions from regulatory authorities, damage to reputation, and loss of consumer trust. Therefore, it is critical that applicants carefully follow these procedures to maintain full compliance and operational legitimacy.
