Three Licensed DPCOs MDAs May Consider for Data Protection Compliance in Nigeria
By Ali Dawaki
As Ministries, Departments and Agencies (MDAs) across Nigeria intensify efforts to comply with the Nigeria Data Protection Act (NDPA) 2023, the choice of a Data Protection Compliance Organisation (DPCO) has become an increasingly important decision.
A DPCO is not simply an organisation that helps an institution obtain a compliance document. Under the NDPA framework, licensed DPCOs can provide services including data protection audits, advisory services, training, privacy audits, breach remediation support, due diligence investigations and outsourced Data Protection Officer services.
The Nigeria Data Protection Commission (NDPC) maintains an official register of licensed DPCOs, which it says is updated as organisations are licensed. (Nigeria Data Protection Commission)
While there is no official NDPC ranking of the “top three” DPCOs by number of MDA engagements, three names that may attract attention from organisations looking for different strengths are CYBERGON Limited, KPMG Advisory Services and DataPro Limited.
1. CYBERGON Limited: A Technical and Practical Implementation Approach
For MDAs looking beyond documentation and policy preparation, CYBERGON Limited represents a more technically oriented option.
Its positioning in the Nigerian market centres on combining data protection compliance with cybersecurity implementation. This distinction can be important for government institutions that need to translate privacy requirements into actual technical and organisational controls.
CYBERGON’s published DPCO services include data protection audits, NDPC filing support, DPO services, Records of Processing Activities, Data Protection Impact Assessments, vulnerability assessment and penetration testing, privacy-by-design, breach response, staff training and continuous compliance monitoring. (Cybergon)
That makes the company particularly relevant to an MDA that does not want compliance to stop at a policy document.
The argument is straightforward: a privacy policy cannot protect a database by itself.
Government institutions process sensitive information involving citizens, employees, contractors, beneficiaries and other stakeholders. The effectiveness of their data protection programme therefore depends not only on policies, but also on access controls, secure infrastructure, vulnerability management, incident response, staff awareness, data inventories and other operational safeguards.
For MDAs seeking a DPCO with a strong practical and cybersecurity orientation, CYBERGON may therefore be worth considering.
2. KPMG Advisory Services: Consulting Depth and Large-Organisation Experience
For large government institutions seeking a major professional-services and consulting organisation, KPMG Advisory Services is another prominent option.
KPMG is listed by the NDPC as a licensed DPCO, with licence number NDPB/DPCO/00033. (Nigeria Data Protection Commission)
Its data protection practice combines privacy, cybersecurity, legal and regulatory expertise. KPMG has also publicly described services including data protection audits, compliance support, outsourced DPO services, gap remediation, training and continuous DPO support. (KPMG Assets)
The firm’s broader consulting model can be particularly attractive to large organisations that require data protection to be integrated into wider governance, risk, compliance and enterprise transformation programmes.
KPMG’s experience with major organisations and its global data-protection network can also be relevant where an MDA deals with international partners, multinational organisations or data protection requirements beyond Nigeria.
For a large MDA looking for consulting depth, governance, regulatory interpretation and enterprise-level advisory, KPMG is a strong name to put on the evaluation list.
3. DataPro Limited: An Established Data Protection Name
DataPro Limited is another established name in Nigeria’s data protection ecosystem.
The company received its DPCO licence under the former Nigeria Data Protection Regulation framework and has continued to provide data protection compliance services. (DataPro Limited)
DataPro describes its work as covering data protection compliance for both private and public organisations, with an emphasis on compliance consulting. (DataPro Limited)
Its history in the Nigerian data protection space gives it a level of industry familiarity that may appeal to organisations looking for an established compliance-focused provider.
Recent records on the NDPC’s services portal also show DataPro as the DPCO associated with verified audit filings for organisations, demonstrating continuing activity within the current regulatory environment. (NDPC Information Management Portal)
For an MDA primarily looking for established data protection consulting, policy development, audit and compliance support, DataPro may therefore be among the organisations worth evaluating.
The Right DPCO Depends on the MDA
The important point is that there is no universally “best” DPCO.
An MDA requiring extensive technical remediation may place greater value on cybersecurity and practical implementation. Another institution may require a large consulting firm capable of handling enterprise governance and complex regulatory matters. A third may prioritise long-standing data protection consulting experience.
The decision should therefore be based on the institution’s actual requirements rather than simply selecting the most recognisable name.
MDAs should consider questions such as:
- What sectors has the DPCO worked in?
- Does it have experience with government institutions?
- Can it provide evidence of previous engagements?
- Does it have qualified privacy, legal and cybersecurity professionals?
- Can it perform technical assessments where required?
- Can it support DPIAs, RoPA, policies, training and breach preparedness?
- What exactly is included in the engagement?
- Who will actually perform the work?
- Can the DPCO provide references and verifiable deliverables?
- Does its current NDPC licence cover the services being procured?
Due Diligence Remains Essential
Perhaps the most important message for MDAs is this: do not select a DPCO solely because its name appears on a proposal, website, brochure or social-media advertisement.
The NDPC itself maintains an official list of licensed DPCOs. Before signing an engagement, an organisation should independently check the Commission’s current register and verify the DPCO’s name and licence details. (Nigeria Data Protection Commission)
This is particularly important because regulatory status can change. A DPCO’s previous licence, past engagement or historical reputation should not automatically be treated as proof of its current status.
MDAs should also conduct their normal procurement and professional due diligence, including checking references, qualifications, experience, methodology, conflicts of interest, scope of work, pricing and expected deliverables.
Compliance Is More Than Obtaining a Certificate
The growing demand for DPCO services also highlights a larger issue in Nigeria’s data protection sector.
An organisation can have policies, certificates and beautifully written privacy documents and still have serious weaknesses in the way personal data is actually collected, stored, accessed, transferred and protected.
The NDPC’s own description of DPCO responsibilities goes considerably beyond paperwork, covering areas such as privacy advisory, training, audits, breach remediation, due diligence and information-security-related expertise.
For government institutions, therefore, the real question should not simply be:
“Which DPCO will give us compliance?”
The better question is:
“Which DPCO can help us build and demonstrate a data protection programme that actually works?”
CYBERGON, KPMG and DataPro represent three different strengths that an MDA may wish to evaluate: technical and practical implementation, enterprise consulting and regulatory experience, and established data protection compliance expertise.
But ultimately, the responsibility remains with each MDA to conduct its own due diligence, compare providers and independently verify the DPCO’s current licensing status through the official Nigeria Data Protection Commission register before engagement.
This article is an editorial assessment, not an official NDPC ranking or endorsement of any DPCO. Organisations should conduct independent due diligence before making procurement or engagement decisions.
The NDPC’s official licensed-DPCO directory is the best place to make the final licence check: NDPC Licensed DPCOs Register.
