To register an NGO in Nigeria for data protection compliance and obtain the necessary certificates under the Nigeria Data Protection Act (NDP Act) 2023 and the related General Application and Implementation Directive (GAID), the organization must register as a Data Controller or Data Processor with the Nigeria Data Protection Commission (NDPC).
NGOs must comply with the general principles of data processing (lawfulness, fairness, transparency, etc.). International NGOs and NGOs need to register as a “Major Data Processing” entity.
Registration Process and Requirements
Registration is conducted online via the official NDPC Information Management Portal (NIMP).
Steps for Registration
- Determine Your Role and Level: Decide if your NGO is a Data Controller (determines the purpose and means of processing personal data) or a Data Processor (processes data on behalf of a controller). Classify your organization based on the volume and sensitivity of data handled (e.g., Major Data Processing – Extra High Level for a large hospital or university; Ordinary High Level for a school or clinic).
- Create an Account: Visit the NDPC portal and register your organization.
- Fill the Form: Complete the online application form with details like your CAC registration number, contact info, type of data processed, DPO’s details, and purpose of data collection.
- Upload Documents: Upload the required supporting documents (listed below).
- Pay the Fee: Pay the non-refundable registration fee through the designated payment gateway. Fees vary by classification (e.g., ₦10,000 for OHL, ₦100,000 for EHL, ₦250,000 for UHL), price may have been reviewed and penalty apply for late registration so cost may be higher. Contact a Licensed DPCO for guidance
- Submit and Track: Submit your application and monitor its status via your dashboard.
Required Documents
Ensure you have digital copies of the following ready for upload:
Upon successful registration and compliance, the NDPC issues 2 formal certificate, confirming that the NGO is registered as a data controller or processor and is compliant with the NDP Act. This is typically an annual process, requiring renewal and annual filings
