Does Your Nigerian Business Need to Register with the NDPC? How to Assess Your Obligations

Does every Nigerian business have to register with the Nigeria Data Protection Commission (NDPC)? No. The formal registration requirement applies to organisations classified as data controllers or data processors of major importance (DCPMIs). However, a company that is not required to register may still have substantial responsibilities under the Nigeria Data Protection Act (NDPA) 2023.

The distinction matters to small shops, schools, hospitals, hotels, online retailers, agencies and technology companies alike. The applicable test is not simply whether a business is registered with the Corporate Affairs Commission, makes a particular amount of money, or employs a specified number of people. It depends on the personal data it processes, the nature of its activities, the sector in which it operates and the NDPC's designation rules.

Verified: 2 November 2026. This guide is general information, not a substitute for advice on your organisation's particular circumstances.

What does NDPC registration actually mean?

The NDPC is the regulator established under Nigeria's 2023 data protection law. Its registration framework identifies certain controllers and processors whose activities are sufficiently significant to require formal regulatory registration and oversight. Section 44 of the NDPA provides the statutory foundation, while the NDPC's General Application and Implementation Directive (GAID) 2025 and its Schedule 7 set out operational rules and classifications.

A data controller decides why and how personal information is processed. An online store deciding what customer information to collect is usually acting as a controller for that activity. A data processor handles personal information on another organisation's instructions; a cloud payroll service may play this role for an employer. A company can be a controller for some activities and a processor for others.

Personal data includes information relating to an identifiable individual: names, phone numbers, email addresses, customer account details, employment records, location data and identifiers, among others. Paper records can count just as much as information held in software.

Three ways your business may qualify as 'of major importance'

Schedule 7 of the NDPC guidance provides three principal triggers for entities that keep or have access to a personal-data filing system, whether analogue or digital. Meeting any one of the triggers may bring an organisation within the DCPMI designation, subject to the notice's exclusions and exemptions.

1. You process the personal data of more than 200 people in six months

The guidance uses a threshold of more than 200 data subjects during a six-month period. A data subject is an individual, not a transaction, invoice or spreadsheet row. When assessing the threshold, count distinct people whose data you process; avoid counting repeat orders from the same customer as different individuals. Consider employees, customers, users and other relevant people, not only paying clients.

For instance, a digital marketing agency maintaining identifiable records for 350 newsletter subscribers over six months should investigate DCPMI registration, even if it has just four employees. A business processing information about exactly 200 people does not satisfy this particular 'more than 200' limb, but it may still be caught by a sector or activity trigger.

2. You provide certain commercial ICT services on other people's devices

The guidance also covers commercial information and communications technology services involving another person's digital device with personal-data storage capacity. This means an eligible device-repair or technical-service business should not assume that a low customer count automatically rules out registration. Assess what access staff have to customers' devices and seek clarification if the boundary is uncertain.

3. You operate in a specifically listed sector

The notice names aviation, communication, education, electric power, export and import, financial services, health, hospitality, insurance, oil and gas, tourism, e-commerce and public service. Organisations and service providers processing personal data in these sectors can qualify independently of the 200-person volume test.

A primary school keeping pupil records, a small guesthouse recording guest identity information, or a clinic managing patient information should therefore evaluate its registration position rather than relying on a small headcount. This is particularly important where children, patients, identification documents or financial records are involved.

Who may not need to register?

Schedule 7 identifies some traders and artisans whose activities do not amount to major data processing, including certain small traders and artisans that keep only routine contact and receipt information. It also refers to informal communities interacting through social media. These descriptions are not a universal exemption for businesses with fewer than 15 employees: sector, activity and other factual circumstances still matter.

Separately, the NDPC's guidance exempts specified categories from registration, including community-based associations, faith-based organisations, foreign embassies and high commissions, judicial or adjudicatory establishments, and multigovernmental organisations. Processing solely for personal or household purposes is addressed differently under the Act.

A trader who is outside the DCPMI registration framework should still treat customer records responsibly. The principles of lawful processing, transparency, security, minimisation and respect for individuals' rights do not disappear simply because an entity is not on the NDPC register.

NDPC registration categories and fees

The NDPC recognises three categories: Ordinary-High Level (OHL), Extra-High Level (EHL) and Ultra-High Level (UHL). The official registration guidance specifies both fees and named types of organisation, alongside volume-based criteria and broader risk factors.

These are not three simple, automatic headcount bands. The notice also lists organisations by type and examines factors such as sensitive data, cloud dependence, cross-border transfers and risk. Its numerical wording leaves cases such as exactly 1,000 or 5,000 data subjects insufficiently explicit. Where your organisation sits at a boundary—or a named sector and volume appear to point to different tiers—obtain a documented classification from the NDPC or a suitably qualified adviser instead of guessing. Check the current official portal for applicable fees before paying; audit-return and other processing fees may be additional.

Seven questions to assess your registration obligation

1. What personal information do we hold? Map customer, employee, supplier-contact, visitor, beneficiary and website-user data, including paper files.
2. Are we a controller, processor or both? Record who decides the purposes of processing and who acts on another party's instructions.
3. How many distinct people are involved in a six-month period? Reconcile records across departments, branches and systems without double-counting.
4. Does our sector appear in Schedule 7? Check actual service activities, not just the general description on the company's CAC certificate.
5. Do we provide covered commercial ICT services involving customers' devices? Assess device-access and repair arrangements.
6. Do any stated exclusions or exemptions apply? Document the specific clause and why the facts fit; avoid casual claims of exemption.
7. Which classification and reporting obligations follow? Compare the named types, scale, risk and current guidance, and escalate uncertainty.

Write the answers in a short assessment file, date it, and assign a person to review it whenever operations change. A documented, reasoned conclusion is more valuable than deciding from a social-media summary.

How to register with the NDPC

If your assessment shows that registration is required, begin with the official NDPC website and its Data Controller/Processor Registration service. Avoid paying an unverified agent or using a lookalike site. The practical sequence is:

1. Identify the organisation and its role. Assemble the legal business name, business address and responsible contact persons.
2. Prepare a processing inventory. Describe the types of personal data, categories and approximate numbers of people, purposes of use and relevant processing systems.
3. Identify recipients, suppliers and transfers. Document processors and service providers, categories of third-party recipients and any countries to which personal information is transferred.
4. Identify your data protection officer where required. Record the officer's contact details and ensure appropriate internal oversight.
5. Determine the category. Compare your organisation with the OHL, EHL and UHL criteria. Resolve ambiguous cases before submitting inaccurate information.
6. Submit through the NDPC's authorised registration channel. Follow live portal requirements, pay only verified official fees and retain submission receipts and acknowledgements.
7. Record the outcome. Save evidence of acceptance and your reference or registration details, and diary subsequent filing or renewal tasks.

Under Article 9(4) of GAID 2025, organisations of major importance must notify the NDPC of significant changes to their latest registration information within 60 days. Registration is therefore not a one-time permission to leave inaccurate company or processing information on file.

Registration is not the same as full data-protection compliance

Business owners sometimes assume that obtaining an NDPC registration certificate makes their website, employee database or customer management system compliant. It does not. Registration and the actual protection of personal information are separate tasks.

For example, a retailer may register but still expose customer numbers in a shared spreadsheet, retain unnecessary identity documents indefinitely or install tracking scripts without properly assessing consent requirements. A hotel may use a reputable booking platform yet lack a clear contract governing what the platform can do with guest information. A school may collect pupil data without explaining its purposes adequately to parents.

Minimum operational priorities include:

• Lawful processing and clear privacy notices: explain which information is collected, why it is needed, the applicable legal basis and relevant rights. Consent is not the only lawful basis, and it should not be used indiscriminately.
• Data minimisation and retention: collect what is necessary, keep it accurate, and apply a defensible retention and secure-deletion policy.
• Access control and security: limit access by role, use multi-factor authentication where appropriate, secure backups, train staff and monitor misuse.
• Supplier accountability: document relevant processor relationships and written data-processing agreements, including cloud and outsourced business services.
• Individual rights: establish a channel to receive and handle access, correction, deletion and other requests in accordance with the law.
• Risk assessments: assess data protection impact before higher-risk processing or deployments where the law or applicable GAID provisions require it.
• Incident response: investigate breaches, preserve records and notify the NDPC within 72 hours of awareness where a breach is likely to risk individuals' rights and freedoms. Higher-risk breaches may also require notifying affected individuals.

These practical issues are not theoretical. FlyingEze has previously reported on an NDPC investigation involving an alleged data breach at the Corporate Affairs Commission , and on the agency's investigation into allegations about users' data involving Temu . An investigation does not itself establish a violation, but such cases show why organisations need functioning controls rather than certificates alone.

Annual renewals, audit returns and compliance officers

GAID 2025 Article 9 separates ongoing requirements by registration category. OHL organisations renew registration every year and are not required to submit an annual Compliance Audit Return as part of that annual renewal. UHL and EHL organisations register once and file CAR annually, ordinarily through an NDPC-licensed Data Protection Compliance Organisation (DPCO), unless the Commission approves otherwise.

Article 10 specifies a 31 March annual CAR deadline for organisations established before 12 June 2023, while those established later have an initial deadline measured 15 months from establishment followed by annual filing. Organisations should confirm the operative filing deadline for their own circumstances, not assume every new company shares the same first filing date. Late CAR filing attracts an administrative penalty equal to 50% of the stipulated filing fee under the GAID.

DCPMIs should also review their obligation to designate a Data Protection Officer (DPO). The officer may be an appropriately qualified employee or external professional. The DPO must be able to engage with management and receive the support needed to oversee data protection matters. Staff education matters too: FlyingEze has reported on data-protection training for INEC personnel , illustrating the continuing operational role of awareness.

Examples: how different Nigerian businesses should think about registration

A neighbourhood provision shop

A small trader keeping only basic phone contacts and receipts may fall outside the major-importance designation under Schedule 7's descriptions. That does not justify publishing customers' phone numbers or ignoring basic security. Expansion into online sales, larger datasets or data-sharing activities can change the assessment.

A primary school with 120 pupils

Education is a specifically listed sector and primary schools are explicitly named in the OHL category. The school should assess registration even though the pupil population is below 200. It should also establish safeguards around children's records and staff access.

A SaaS platform with 1,600 distinct Nigerian users

The platform clearly crosses the general 200-person trigger. Volume may indicate EHL, but a fintech or public social-media product can fall under a specifically named UHL type. Its precise services, risk profile and classification must be reviewed; the business should not determine its fee from headcount alone.

A hotel with 20 rooms

Hospitality appears on the sector list, and hotels or guesthouses with fewer than 50 suites are named in OHL. Guest ID copies, bookings, access logs and payment data still require appropriate protections. A hotel chain with different processing scale or business structure may need a different classification.

Common mistakes to avoid

Confusing CAC registration with NDPC registration. Incorporation is about the legal existence of a business; NDPC registration concerns specified personal-data activities and obligations.

Using employee count as the sole test. A five-person team can process thousands of people's data, while a business may be captured simply because of its sector or ICT activities.

Assuming all firms must pay an NDPC registration fee. The registration requirement concerns DCPMIs; other organisations still need to comply with applicable substantive privacy duties.

Assuming one numerical threshold automatically fixes the tier. Named organisation types and risk factors matter, and exact boundary cases require clarification.

Ignoring vendors or international hosting. Data moving into cloud services or through outsourced tools is still part of your accountability assessment.

Confusing registration with a completed audit. Registration does not replace an ongoing privacy programme, and audit-return rules differ by tier.

What should your business do this week?

Begin with a simple data inventory, calculate six-month unique-person volume, identify any named sector or ICT trigger, and document your provisional classification. Then review the official GAID 2025 text and Schedule 7 guidance . If the outcome is ambiguous, consult a qualified Nigerian data-protection lawyer or an NDPC-licensed DPCO rather than guessing.

Next, inspect your privacy notice, customer and employee records, permissions, third-party contracts and incident reporting plan. If you use digital operations software, check the actual security and data-handling terms of each provider instead of assuming any particular product guarantees regulatory compliance.

Frequently asked questions

Does every CAC-registered business need NDPC registration?

No. Formal NDPC registration generally applies to designated data controllers and processors of major importance, assessed under the statutory and regulatory tests. CAC incorporation alone is not the criterion.

Can a company with fewer than 200 customers still need to register?

Yes. Certain sectors and commercial ICT activities are independent routes into the major-importance designation; customer count is not the only measure.

Is NDPC registration the same as compliance with the Nigeria Data Protection Act?

No. Registration is one regulatory obligation. Lawful processing, transparency, security, individual rights, vendor oversight and other duties can apply whether or not formal registration is required.

How often do registered businesses renew or file returns?

Generally, OHL organisations renew registration annually, while EHL and UHL organisations file annual CAR rather than renewing registration every year, subject to current NDPC directives and individual circumstances.

Where can I confirm the latest registration process?

Use the Nigeria Data Protection Commission's official website and consult the primary legal documents and authorised channels before submitting information or paying any fee.

The bottom line

The key question is not, 'Does my company have data?' but, 'What personal data do we process, whose data is it, in what sector or activity, and does the NDPC designate us as of major importance?' Answer those questions systematically. Register if required, but treat registration as the beginning of a defensible privacy programme—not the end of one.