NDPA compliance audit and requirements

To comply with regulations like Nigeria’s Data Protection Act (NDPA) and the EU’s General Data Protection Regulation (GDPR), data controllers and processors must conduct periodic, comprehensive compliance audits. These audits are essential for identifying vulnerabilities, managing risks, and demonstrating accountability to regulators and the public.

Mandatory audit requirements under Nigerian law

Under the Nigeria Data Protection Act (NDPA), organizations must perform annual compliance audits and submit returns to the Nigeria Data Protection Commission (NDPC) if they meet certain criteria.

Who must file: The requirement applies to all data controllers and processors, with stricter rules for organizations of Major Importance (DCMI/DPMI).
Major Importance thresholds: An organization is typically classified as Major Importance if it processes the personal data of 2,000 or more data subjects within a 12-month period, or 1,000 within a 6-month period.
The audit process: An organization must engage a Data Protection Compliance Organization (DPCO), which is a firm licensed by the NDPC to conduct audits and other compliance-related services. The DPCO will assess the organization’s data protection framework and file the Compliance Audit Report (CAR) with the NDPC.
Deadline: For organizations established before June 12, 2023, the CAR must be filed by March 31st of each year. Those established after this date must file within 18 months of their establishment and then annually.

What a compliance audit entails

A comprehensive data privacy audit typically involves a systematic, four-phase assessment to review an organization’s policies, processes, and systems.

Phase 1: Risk identification (As-is analysis)

The auditor or audit team performs a “current state” analysis of all data processing activities.

Data inventory: Create a detailed catalog of all personal data collected, including what data is collected, where it is stored, and with whom it is shared.
Lawful basis: Confirm that a valid, legal justification exists for processing all personal data.
Data flow mapping: Document how personal data moves through the organization, including cross-border data transfers.
Employee training and awareness: Review the effectiveness of training and ensure employees are aware of their data protection obligations.

Phase 2: Risk assessment

This phase evaluates the identified risks and vulnerabilities to determine their potential impact.

Security measures: Assess technical safeguards like encryption, access controls, and multi-factor authentication.
Vulnerability testing: Conduct vulnerability and penetration tests to find weaknesses in networks and applications.
Third-party vendors: Review agreements with third-party service providers to ensure they have adequate data protection measures.

Phase 3: Risk management and remediation

The organization develops a detailed action plan to address identified gaps and strengthen its controls.

Develop policies: Create or update key policies, including privacy policies, data retention schedules, and breach notification procedures.
Implement controls: Introduce new technical and organizational measures to fix identified vulnerabilities.
Assign responsibility: Designate responsibility for implementing corrective actions to specific individuals or teams.

Phase 4: Monitoring and documentation

The final phase focuses on continuous compliance, which involves documenting all audit findings, action plans, and ongoing monitoring activities.

Continuous monitoring: Establish mechanisms for ongoing monitoring of privacy practices to adapt to new regulatory changes.
Maintain records: Keep detailed records of all processing activities and compliance measures to demonstrate accountability.
Review and update: Conduct regular reviews and update the data protection framework in response to changes in technology or law