NDPC Registration in Nigeria: Does Your Business Need to Register?

Nigeria Data Protection Compliance: What Businesses Must Do Under the NDPA

Not every Nigerian business that processes personal data must register with the NDPC. Registration specifically applies to organisations designated as Data Controllers or Data Processors of Major Importance (DCPMIs). The current framework considers factors including the number of people whose data is processed, the organisation’s sector, the type of processing and the significance of the information involved.

A Nigerian business does not need to call itself a technology company before data-protection law becomes relevant. An online shop may hold customers’ names, phone numbers and delivery addresses. An employer keeps staff records. A clinic handles health information. Schools process information about pupils and parents, while websites and apps can collect account, device and usage data.

The Nigeria Data Protection Act 2023 regulates the processing of personal data, but there is an important distinction for business owners: being subject to the Act does not automatically mean your organisation must register with the Nigeria Data Protection Commission. Registration specifically applies to organisations that qualify as Data Controllers or Data Processors of Major Importance.

First: does your business process personal data?

Personal data is information relating to an identifiable person. Processing is broader than simply collecting it; it can include storing, using, organising, sharing, retrieving, altering or deleting information.

For many businesses, common examples look like this:

The first compliance step is therefore not filling out a registration form. It is understanding what personal information your organisation actually handles, why it needs it and where that information goes.

Who needs to register with the NDPC?

The NDPC’s current DCPMI Guidance Notice provides several routes through which an organisation can be designated as being of major importance.

One trigger is processing the personal data of more than 200 data subjects within six months. But 200 is not a universal exemption threshold.

The guidance also covers certain commercial ICT activities and organisations operating in specified sectors, including communications, education, electricity, financial services, healthcare, hospitality, insurance, oil and gas, tourism, e-commerce and public service.

That means a business should not simply conclude:

“We have fewer than 200 customers, so NDPC registration cannot apply to us.”

The organisation’s sector, processing activities, sensitivity of the information and other designation criteria can matter too. The NDPC’s own compliance FAQs specifically contemplate circumstances in which an organisation processing fewer than 200 data subjects can still fall within the Ordinary-High category.

What are the three NDPC registration levels?

The framework divides DCPMIs into three broad categories:

These numbers are not the only classification criteria. The NDPC also considers factors such as sensitive data, financial assets, cloud infrastructure, cross-border processing and the organisation’s particular activities.

Section 44 of the Act requires an organisation that becomes a DCPMI to register within six months. A significant change to information previously supplied during registration must generally be notified to the Commission within 60 days.

Registration does not mean your business is fully compliant

Receiving an NDPC registration does not certify every data-processing activity inside the organisation. Compliance continues after registration. A business still needs to consider why it collects information, what lawful basis supports the processing, whether it collects more information than necessary, who receives the data, how securely it is stored and how long it is retained.

If an external service processes customer information, the business also needs to understand the relationship with that provider rather than assuming outsourcing transfers responsibility. This is increasingly important when businesses connect customer records, emails or documents to AI services. TechView Africa’s guide to checking AI permissions before connecting email, files or photographs explains why third-party access itself deserves scrutiny.

Businesses also need a plan for incidents. Nigeria uses risk-based breach-notification requirements, meaning the response can depend on the likelihood and severity of harm. TVA has separately compared Nigeria’s data-breach notification rules with five other African countries.

Does your business need a Data Protection Officer?

For businesses that qualify as data controllers of major importance, Section 32 of the NDP Act requires the designation of a Data Protection Officer with appropriate knowledge of data-protection law and practice.

The DPO can be an employee or can perform the role under a service contract. Responsibilities include advising the organisation, monitoring compliance and serving as a contact point for the NDPC. The current GAID further develops the governance expectations around DPOs.

A five-step NDPC compliance check for your business

Before deciding that you need or do not need to register, answer five questions:

1. What personal data do we process? Include customers, employees, contractors, website users and other identifiable people.
2. How many people’s data do we process within six months? Count data subjects, not database rows.
3. What sector and activities are we involved in? The DCPMI framework is not based on numbers alone.
4. Are we a controller, processor or both? Your role may differ across business activities.
5. What happens after registration? Determine whether you need annual CAR filings, registration renewal, a DPO or additional compliance measures.

The NDPC reported that more than 38,000 DCPMIs were under its regulatory oversight by the end of 2025, showing that registration is already relevant to a substantial number of Nigerian organisations.

Our Recommendation

Do not begin your data-protection programme by buying a certificate or assuming your company is too small to matter.

Begin with a data inventory. Document what personal information the business collects, whose information it is, why it is needed, who can access it, which external services receive it and when it should be deleted. Then compare your actual processing against the NDPC’s current DCPMI criteria.

If your classification remains uncertain—particularly where you handle sensitive information, operate in a regulated sector or process information at scale, consider obtaining advice from an appropriately qualified privacy professional or a licensed Data Protection Compliance Organisation.

Most importantly, do not confuse “registered with the NDPC” with “compliant with the NDPA.” Registration is a regulatory step. Responsible data protection is an ongoing business obligation.