v6.2 — Now Available

NDPA Compliance
Made Beautiful

The complete React + TypeScript toolkit for Nigeria Data Protection Act 2023 and NDPC GAID 2025 compliance — ship consent, DSR, DPIA, and breach notifications in minutes, then gate it all in CI.

Free NDPA Audit · 5 min Get Started View on GitHub

app/layout.tsx

tsx

// app/layout.tsx
import { NDPRProvider } from '@tantainnovative/ndpr-toolkit';
import '@tantainnovative/ndpr-toolkit/styles';

export default function RootLayout({ children }) {
  return (
    <NDPRProvider organizationName="MyApp">
      {children}
    </NDPRProvider>
  );
}

Compliance Modules

1,500+

Passing Tests

Runtime Dependencies

18–19

React Versions

Quickstart

Full Compliance in 3 Files

Drop in three files and you have a consent banner, a privacy policy page, and a data request portal — all NDPA-compliant.

app/layout.tsx

tsx

// app/layout.tsx
import { NDPRProvider } from '@tantainnovative/ndpr-toolkit';
import '@tantainnovative/ndpr-toolkit/styles';

export default function RootLayout({ children }) {
  return (
    <html lang="en">
      <body>
        <NDPRProvider
          organizationName="Acme Corp"
          dpoEmail="privacy@acme.ng"
          ndpcRegistrationNumber="NDPC-2026-12345"
        >
          {children}
        </NDPRProvider>
      </body>
    </html>
  );
}

Modules

Everything Compliance Needs

Eight purpose-built modules, each mapped to the sections of the Nigeria Data Protection Act 2023 it supports.

Core

Consent Management

Granular consent banners with audit trails, category management, and NDPA-compliant withdrawal flows.

Explore

Critical

Breach Notification

72-hour NDPC deadline tracking, breach severity triage, and a live notification-readiness panel scored against GAID 2025 Article 33.

Explore

DSR Portal

Pre-built portal for access, erasure, rectification, portability, and objection requests — ready in one import.

Explore

DPIA Toolkit

Questionnaire-driven risk assessments with severity scoring, mitigation tracking, and PDF export.

Explore

Privacy Policy

Interactive wizard generating NDPA-compliant privacy policies with custom sections and version history.

Explore

Lawful Basis

Document and manage legal grounds for each processing activity with purpose limitation checks.

Explore

Cross-Border Transfers

Safeguard evaluator for international data transfers with adequacy decisions and SCCs management.

Explore

ROPA Builder

Maintain your Record of Processing Activities with asset linking, controller mapping, and audit exports.

Explore

Architecture

Choose Your Layer

Use the high-level presets, drop down to composable components, or go full-headless with hooks and core utilities.

Presets

Drop-in components with zero config. Works out of the box.

Components

Composable, styled building blocks you control.

Hooks

Logic-only hooks — bring your own UI.

Core

Pure TypeScript utilities, framework agnostic.

Adapters

Swap storage: localStorage, cookies, your API, or Prisma and Drizzle via ndpr-recipes.

tsx

// One import — fully styled, NDPA-ready
import { NDPRConsent } from '@tantainnovative/ndpr-toolkit/presets';

export default function App() {
  return (
    <NDPRConsent
      position="bottom"
      onSave={(settings) => console.log(settings)}
    />
  );
}

Compliance Score

Know Your Score

Run a real-time compliance audit against the NDPA 2023 framework and get an actionable breakdown of gaps.

73/ 100

Consent Management

DSR Portal

Breach Notification

DPIA

Lawful Basis

Cross-Border

ROPA

compliance-check.ts

import { getComplianceScore } from '@tantainnovative/ndpr-toolkit';

const report = getComplianceScore({
  consent: { hasConsentMechanism: true, hasPurposeSpecification: true,
    hasWithdrawalMechanism: true, hasMinorProtection: false, consentRecordsRetained: true },
  dsr: { hasRequestMechanism: true, supportsAccess: true, supportsRectification: true,
    supportsErasure: true, supportsPortability: false, supportsObjection: true, responseTimelineDays: 30 },
  dpia: { conductedForHighRisk: true, documentedRisks: true, mitigationMeasures: false },
  breach: { hasNotificationProcess: true, notifiesWithin72Hours: true, hasRiskAssessment: true, hasRecordKeeping: true },
  policy: { hasPrivacyPolicy: true, isPubliclyAccessible: true, lastUpdated: '2026-01-15', coversAllSections: true },
  lawfulBasis: { documentedForAllProcessing: false, hasLegitimateInterestAssessment: false },
  crossBorder: { hasTransferMechanisms: false, adequacyAssessed: false, ndpcApprovalObtained: false },
  ropa: { maintained: false, includesAllProcessing: false, lastReviewed: '2025-11-01' },
});

// report.score → 0–100, report.rating → 'excellent' | 'good' | 'needs-work' | 'critical'
// report.modules → per-module breakdown with recommendations

73/100 overall score with a rating

Per-module pass/fail breakdown

Actionable gap recommendations

Ratings: excellent, good, needs work, critical

NDPC GAID 2025

Register, Schedule, and Audit in CI

The GAID 2025 layer: classify your DCPMI designation tier, schedule Compliance Audit Returns, and check breach notifications — then gate it all in CI with the ndpr audit CLI.

ci.sh

bash

# Gate compliance in CI — exits non-zero on failure
npx ndpr audit --init           # scaffold ndpr.audit.json
npx ndpr audit --min-score 80

# NDPA 2023 Compliance Audit
# ✓ Overall compliance score        82/100 (good); minimum 80.
# ✓ DCPMI designation (GAID 2025)   UHL — ₦250,000/yr; file CAR annually.
# ! Breach notification — incident   60% complete; 18h remaining.
# Verdict: PASS

DCPMI designation classifier

Resolve likely UHL / EHL / OHL designation and annual NDPC fee estimate from data-subject volume.

Compliance Audit Returns scheduler

Initial-audit due date and the next annual NIMP filing deadline, with overrides.

Breach-notification checker

Score a breach against the Section 40 / Article 33 mandated content and the 72-hour clock.

ndpr audit — CI gate

One command scores everything and exits non-zero on failure. Drop it into any pipeline.

Read the audit CLI guide

New in v6.2

Evidence, Not Just Checkboxes

Tools that produce the records the NDPA and GAID 2025 expect: who you really hold data on, where Nigerian identifiers leak, and a paper trail for automated decisions and complaints.

Derived data-subject estimate

Count guarantors, next of kin and uploaded contacts alongside direct customers, and see whether they move your DCPMI tier.

Nigerian PII scanner

Find phone numbers, NIN- and BVN-shaped numbers, NUBANs, cards, CAC numbers and plates in code, fixtures and logs. Values are masked.

Section 37 decision receipts

A short code and plain-language notice for every automated decision, so the person can ask for human review.

Erasure vs. retention

A statutory exceptions register and draft outcomes when an erasure request collides with a retention duty. Every outcome needs sign-off.

Schema-as-RoPA

Annotate Prisma models with /// @ndpr, lint for unannotated personal fields, and draft RoPA entries from the schema.

Grievance packets

Compose a GAID 2025 Schedule 9 grievance notice for email, WhatsApp and SMS, and a Section 46 complaint if it goes unanswered.

Outputs are drafts. Have your DPO or counsel review them before they reach a data subject or the NDPC.

Read the evidence tools guide Try the data-subject calculator

ci.sh

bash

# How many people's data do you really hold?
npx ndpr dcpmi --direct 1200 \
  --relations guarantor:2:0.6,uploaded_contact:150:0.3

# Direct subjects:            1,200  -> tier EHL
# Third-party subjects:       55,440
# Direct plus third-party:    56,640  -> tier UHL
# - Counting third-party subjects moves the estimate from EHL to UHL.
#   Raise this with your DPO and counsel before filing.

# Fail CI on Nigerian identifiers in fixtures and logs (masked)
npx ndpr scan src test --fail-on high
# src/seed.ts:1  phone_ng     high    *********67
# src/seed.ts:1  national_id  medium  *********89

# Draft your RoPA from annotated Prisma models
npx ndpr schema lint && npx ndpr schema ropa

Used by