NDPC Registration: Who Must Register and How (2026 Guide)
If your business processes personal data of 200 or more individuals within any six-month period, you almost certainly need to register with the Nigeria Data Protection Commission (NDPC). This applies whether you are a fintech startup, a hospital, or a corner shop with a loyalty programme. The threshold is lower than most business owners expect.
This guide covers who must register, the tier system, what documents to prepare, and how to complete registration on the NDPC portal.
Do You Need to Register?
The NDPC uses a simple threshold: if your organisation processes the personal data of 200 or more data subjects within a rolling six-month window, you are required to register as a data controller or data processor.
"Processing" is broad — it includes collecting, storing, using, sharing, or deleting personal data. A customer database with 200 names and phone numbers qualifies. An e-commerce site that has served 200 customers qualifies. A payroll system covering 200 employees across client companies qualifies you as a data processor.
The Three Tiers: Understanding GAID 2025 Classification
The NDPC's General Application and Implementation Directive (GAID) 2025 introduced a three-tier classification system. Your tier determines your annual registration fee and your filing obligations. One distinction trips up most businesses: the registration fee below is separate from the Compliance Audit Return (CAR) filing fee that UHL and EHL organisations pay when they file their annual audit (the CAR fee is larger and scales with the number of data subjects you process). The figures below are the GAID 2025 registration fees.
Ultra High Level (UHL)
Annual registration fee: ₦250,000
This tier covers organisations where data processing is massive in scale and sensitive in nature: commercial banks, telcos, insurers, multinationals, electricity distribution and oil & gas companies, payment gateways, and fintechs — or any organisation processing the personal data of more than 5,000 data subjects in a six-month period. If you are regulated by the CBN or NCC, you are almost certainly UHL.
UHL organisations face the most rigorous requirements, including mandatory DPIAs, a qualified Data Protection Officer (DPO), and an annual Compliance Audit Return (CAR).
Extra High Level (EHL)
Annual registration fee: ₦100,000
EHL covers government MDAs, microfinance and mortgage banks, higher institutions, and tertiary/secondary hospitals — or organisations processing 1,000–5,000 data subjects in a six-month period. Like UHL, EHL organisations register once and file an annual CAR.
Ordinary High Level (OHL)
Annual registration fee: ₦10,000
OHL is the entry-level tier — primary/secondary schools, training providers, primary health centres, and other organisations over the 200-data-subject threshold (200–999 data subjects in six months) that do not fall into UHL or EHL. Crucially, OHL organisations renew their registration with the NDPC annually and — unlike UHL and EHL — are not required to file an annual Compliance Audit Return. The lower fee reflects a proportionate approach, not a lighter set of obligations under the NDPA.
Self-Assessment: Determine Your Tier in Five Questions
Answer these five questions to identify where you likely fall:
- Is your organisation regulated by the CBN, NCC, SEC, or NAICOM? If yes, you are UHL.
- Do you operate in oil and gas, mining, or extractive industries? If yes, you are UHL.
- Do you process the personal data of more than 5,000 data subjects in any six-month period? If yes, you are UHL by volume — regardless of sector.
- Are you in a listed EHL sector (an MDA, microfinance or mortgage bank, higher institution, tertiary/secondary hospital) or do you process 1,000–5,000 data subjects in six months? If yes, you are EHL.
- Do you process 200–999 data subjects in six months and answered "no" to all the above? You are OHL — renew your registration annually (no CAR required).
What Documents to Prepare Before Starting
Gather these before you open the NDPC portal. Having everything ready prevents a half-completed registration that stalls for weeks:
- Certificate of incorporation (CAC certificate and Form CAC 1.1)
- Tax Identification Number (TIN) and evidence of tax compliance
- Organisational structure showing data protection governance
- Data processing inventory — categories of personal data, purposes, storage locations, retention periods, and third parties with access
- Privacy policy that meets NDPA requirements
- Data Protection Officer details (if applicable) — name, qualifications, and contact information
- Evidence of data protection measures — technical and organisational security controls in place
Step-by-Step Registration on the NDPC Portal
Registration is handled online at services.ndpc.gov.ng. Here is what to expect at each stage:
1. Create Your Account
Register an organisational account with your email address, organisation name as it appears on your CAC certificate, and RC number. Verify your email to activate.
2. Complete Your Organisational Profile
Fill out the organisational profile form covering your sector, size, contact details, and DPO information. Be accurate — this determines your tier classification and compliance framework.
3. Submit Your Data Processing Inventory
Upload your data processing inventory. The portal asks you to declare categories of personal data you process, lawful bases, whether you transfer data outside Nigeria, and any data processors you engage. Organisations that have built their ROPA can transfer the information directly.
4. Pay the Registration Fee
You will receive a payment notification with your assigned tier and fee. Payment is made through the portal's integrated payment system. Keep your receipt for records and annual renewal.
5. Receive Your Registration Certificate
Once payment is confirmed and your submission approved, the NDPC issues a registration certificate valid for one year. Display it on your website and physical premises — it signals to customers and partners that your organisation takes data protection seriously.
The Annual Compliance Audit Return (CAR)
Registration is not a one-time event. UHL and EHL organisations register once and then file an annual Compliance Audit Return (CAR) by March 31 each year (the NDPC extended the 2025 cycle to 30 May 2026). OHL organisations do not file a CAR — they renew their registration with the Commission annually instead. The CAR covers your data processing activities over the preceding year, any breaches that occurred, the status of your data protection measures, and any changes to processing activities, and is filed through a licensed Data Protection Compliance Organisation (DPCO).
Missing your deadline can trigger enforcement action: late CAR filing adds up to 50% of the filing fee, and failure to file can reach 2% of annual gross revenue or ₦10,000,000. Treat it like a tax filing — put it in the calendar, assign someone to own it, and start preparing early. For the full breakdown, see the Compliance Audit Returns 2026 guide.
How the NDPA Toolkit Helps
Two modules in the toolkit directly support registration:
The ROPA module helps you build the data processing inventory required for Step 3. It walks you through each processing activity and produces a structured record you can submit to the NDPC portal.
The Privacy Policy generator creates a policy covering all NDPA requirements, customised to your actual data practices.
For a full walkthrough of every compliance requirement beyond registration, explore the documentation.
Start Now, Not Later
The NDPC is actively expanding its enforcement capacity. Organisations that register early demonstrate good faith and are far better positioned if a complaint or audit arises. Those that delay while processing above the threshold are accumulating risk every day.
The registration itself takes one to two weeks with documents ready. The preparation — building your data inventory, writing your privacy policy, identifying your tier — is where the real work happens. Start there, and registration is straightforward.
The NDPA Toolkit is open-source and available on GitHub. Built for Nigerian businesses by Nigerian developers.