If your business collects, stores, or processes the personal data of up to 200 or more Nigerians within a six-month period—whether it’s customer phone numbers, BVNs, email addresses, or employee payroll—you are legally classified as a data controller or data processor. Under the Nigeria Data Protection Act (NDPA) 2023, managing this data comes with strict accountability.
One of your primary compliance duties is registering with the regulatory body, the , and renewing your data protection status annually.
If you are a novice to Nigerian corporate compliance, this straightforward guide will show you exactly how to handle your renewal seamlessly.
What is NDPC Registration?
The NDPA 2023 mandates that organizations operating in Nigeria must register their data processing activities. When you complete this on the official portal, you are issued a certificate.
This certificate proves to the NDPC, your clients, and your investors that your business treats privacy as a priority and operates within the bounds of Nigerian law. However, this registration is not a one-time setup—it expires and must be renewed every 12 months.
Understanding the NDPC Fee Tiers
Nigeria categorizes businesses into distinct compliance tiers based on the volume and sensitivity of the data they handle. Your annual renewal requirements and costs depend entirely on your tier:
1. Ordinary-High Level (OHL): Covers SMEs, primary/secondary schools, local vendors, and businesses processing data for 200 to 999 subjects. The annual fee is 10,000 Naira.
2. Extra-High Level (EHL): Covers higher institutions, secondary/tertiary hospitals, microfinance banks, and government MDAs. The annual fee is 100,000 Naira.
3. Ultra-High Level (UHL): Covers commercial banks, telecommunications companies, major fintechs, insurance firms, and multinationals. The annual fee is 250,000 Naira.
Note: While OHL organizations simply renew their registration online annually, EHL and UHL entities are generally required to additionally file an annual Compliance Audit Return (CAR).
Step-by-Step Renewal Process
The renewal process is fully digital and managed via the . Here is how to complete it:
1. Conduct a “What’s Changed?” Check
Before logging in, assess your business growth over the last year. Ask yourself:
Has our data volume scaled up? (e.g., if an OHL business grows to process data for over 1,000 individuals, it must transition to the EHL tier).
Have we started handling more sensitive data (like biometrics or financial records)?
Any changes to your Data Protection Officer (DPO) or internal privacy policies?
1. Log Into the Portal if you decide to do it yourself. Note: it’s recommended to ask for support from a licensed DPCO.
Visit the official . You will need your organization’s profile login credentials,
1. Update Your Records
Review your pre-filled information from the previous year. Update any changes to your business address, sector classification, or data processing inventory.
1. Pay the Prescribed Fee
Generate a payment invoice through the integrated portal gateway (utilizing Remita) for your specific classification tier.
1. Submit and Download Your Certificate
Once payment is verified, submit your declaration. The NDPC will review the submission and issue your updated compliance status/certificate, keeping your account active for the next 12 months.
Risks of Skipping Your Renewal
Regulatory Penalties: The NDPC has heavily ramped up its enforcement actions against default data controllers. Operating without an active registration exposes your company to hefty administrative fines.
The NDPC maintains a public register of compliant organizations. If your status lapses, your company may lose its spot on the list, which can damage your reputational standing with corporate partners, clients, and procurement boards.
Audit Triggers:
Allowing your account to become inactive flags your business for potential compliance audits by licensed Data Protection Compliance Organizations (DPCOs) or the commission itself.
Final Takeaway
Renewing your data protection status under the NDPA 2023 is a core component of modern corporate governance in Nigeria. By dedicating less than an hour to updating your records annually on the , you shield your business from legal liabilities, build trust with the Nigerian public, and ensure smooth, lawful operations.
Disclaimer: Data protection laws vary by jurisdiction and industry. If your business handle global data flows or highly sensitive government information, consider consulting a certified Data Protection Officer (DPO) or privacy legal expert.
