NDPC Registration: Who Must Register and How (2026 Guide)
A complete guide to NDPC registration for Nigerian businesses. Determine if you must register, understand the tier system, and prepare your documentation.
Abraham Esandayinze Tanta
NDPC Registration: Who Must Register and How (2026 Guide)
If your business processes personal data of 200 or more individuals within any six-month period, you almost certainly need to register with the Nigeria Data Protection Commission (NDPC). This applies whether you are a fintech startup, a hospital, or a corner shop with a loyalty programme. The threshold is lower than most business owners expect.
This guide covers who must register, the tier system, what documents to prepare, and how to complete registration on the NDPC portal.
Do You Need to Register?
The NDPC uses a simple threshold: if your organisation processes the personal data of 200 or more data subjects within a rolling six-month window, you are required to register as a data controller or data processor.
"Processing" is broad — it includes collecting, storing, using, sharing, or deleting personal data. A customer database with 200 names and phone numbers qualifies. An e-commerce site that has served 200 customers qualifies. A payroll system covering 200 employees across client companies qualifies you as a data processor.
The Three Tiers: Understanding GAID 2025 Classification
The NDPC's General Application and Implementation Directive (GAID) 2025 introduced a three-tier classification system. Your tier determines your annual filing fee and the level of regulatory scrutiny you face.
Ultra High Level (UHL)
Annual filing fee: N1,000,000
This tier covers organisations where data processing is massive in scale and sensitive in nature. Banks, insurance companies, telcos, oil and gas companies, and large government agencies fall here. If you are regulated by the CBN, NCC, or operate in extractive industries, you are almost certainly UHL.
UHL organisations face the most rigorous compliance requirements, including mandatory Data Protection Impact Assessments (DPIAs), appointment of a qualified Data Protection Officer (DPO), and detailed annual compliance reporting.
Extra High Level (EHL)
Annual filing fee: N500,000
EHL covers mid-scale organisations that process significant volumes of personal data outside the highest-risk sectors. Hospitals, universities, mid-size technology companies, logistics firms, and large retail chains typically fall here. If your organisation routinely processes sensitive personal data — health records, biometric data, educational records — you are likely EHL regardless of size.
Ordinary High Level (OHL)
Annual filing fee: N100,000
OHL is the entry-level tier for any organisation that meets the 200-data-subject threshold but does not fall into UHL or EHL. Small and medium businesses, professional service firms, local retailers with customer databases, and startups typically register here. The lower fee reflects a proportionate approach to regulation, not a lighter set of requirements — OHL organisations still have full compliance obligations under the NDPA.
Self-Assessment: Determine Your Tier in Five Questions
Answer these five questions to identify where you likely fall:
- Is your organisation regulated by the CBN, NCC, SEC, or NAICOM? If yes, you are UHL.
- Do you operate in oil and gas, mining, or extractive industries? If yes, you are UHL.
- Do you routinely process sensitive personal data (health records, biometric data, genetic data, children's data)? If yes, you are likely EHL.
- Does your organisation employ more than 200 staff or serve more than 10,000 customers annually? If yes, you are likely EHL.
- Do you process the personal data of 200 or more individuals but answered "no" to all the above? You are OHL.
What Documents to Prepare Before Starting
Gather these before you open the NDPC portal. Having everything ready prevents a half-completed registration that stalls for weeks:
- Certificate of incorporation (CAC certificate and Form CAC 1.1)
- Tax Identification Number (TIN) and evidence of tax compliance
- Organisational structure showing data protection governance
- Data processing inventory — categories of personal data, purposes, storage locations, retention periods, and third parties with access
- Privacy policy that meets NDPA requirements
- Data Protection Officer details (if applicable) — name, qualifications, and contact information
- Evidence of data protection measures — technical and organisational security controls in place
Step-by-Step Registration on the NDPC Portal
Registration is handled online at services.ndpc.gov.ng. Here is what to expect at each stage:
1. Create Your Account
Register an organisational account with your email address, organisation name as it appears on your CAC certificate, and RC number. Verify your email to activate.
2. Complete Your Organisational Profile
Fill out the organisational profile form covering your sector, size, contact details, and DPO information. Be accurate — this determines your tier classification and compliance framework.
3. Submit Your Data Processing Inventory
Upload your data processing inventory. The portal asks you to declare categories of personal data you process, lawful bases, whether you transfer data outside Nigeria, and any data processors you engage. Organisations that have built their ROPA can transfer the information directly.
4. Pay the Registration Fee
You will receive a payment notification with your assigned tier and fee. Payment is made through the portal's integrated payment system. Keep your receipt for records and annual renewal.
5. Receive Your Registration Certificate
Once payment is confirmed and your submission approved, the NDPC issues a registration certificate valid for one year. Display it on your website and physical premises — it signals to customers and partners that your organisation takes data protection seriously.
The Annual Compliance Audit Return (CAR)
Registration is not a one-time event. Every registered organisation must file an annual Compliance Audit Return (CAR) by March 31 each year. The CAR covers your data processing activities over the preceding year, any breaches that occurred, the status of your data protection measures, and any changes to processing activities.
Missing the March 31 deadline can trigger enforcement action, including fines and suspension of your registration. Treat it like a tax filing — put it in the calendar, assign someone to own it, and start preparing in January.
How the NDPA Toolkit Helps
Two modules in the toolkit directly support registration:
The ROPA module helps you build the data processing inventory required for Step 3. It walks you through each processing activity and produces a structured record you can submit to the NDPC portal.
The Privacy Policy generator creates a policy covering all NDPA requirements, customised to your actual data practices.
For a full walkthrough of every compliance requirement beyond registration, explore the documentation.
Start Now, Not Later
The NDPC is actively expanding its enforcement capacity. Organisations that register early demonstrate good faith and are far better positioned if a complaint or audit arises. Those that delay while processing above the threshold are accumulating risk every day.
The registration itself takes one to two weeks with documents ready. The preparation — building your data inventory, writing your privacy policy, identifying your tier — is where the real work happens. Start there, and registration is straightforward.
The NDPA Toolkit is open-source and available on GitHub. Built for Nigerian businesses by Nigerian developers.