Your organization must register with the Nigeria Data Protection Commission (NDPC) if it is a “data controller or processor of major importance” (DCPMI). This includes organizations that process personal data for over 200 data subjects within a six-month period or operate in designated sectors like finance, health, education, or telecommunications. All other organizations that process personal data are required to register at the start of their operations and renew annually.
Criteria for registering as a DCPMI
- Processing a large volume of data: You process the personal data of over 200 data subjects within a six-month period.
- Operating in key sectors: You process personal data in one of the following sectors designated as critical to Nigeria’s economy and security:
- Aviation
- Communications
- Education
- Electric power
- Financial services
- Health
- Hospitality
- Insurance
- Oil and gas
- Public service
- Tourism
- e-commerce
- Export and import
- Providing specific services: You provide commercial Information Communication Technology (ICT) services.
Registration for all other organizations
- Even if your organization does not meet the DCPMI threshold, if it processes personal data, it must register with the NDPC at the start of its operations.
- This registration must be renewed on an annual basis.
How to register
- All organizations that meet the criteria can register through the NDPC’s online portal.
- Note that while some registration deadlines have passed, registration is still required and penalties may apply for late registration.
- Foreign organizations must also have a local address in Nigeria to complete registration.
