DCPMI Registration & Compliance Audit Returns

Classify Data Controllers/Processors of Major Importance and schedule NDPC Compliance Audit Returns under GAID 2025

What this covers

The NDPC General Application and Implementation Directive (GAID) 2025 requires organisations that qualify as a Data Controller/Processor of Major Importance (DCPMI) to register with the Commission and pay an annual fee tied to their tier. UHL and EHL organisations register once and file Compliance Audit Returns (CAR) — an initial audit within 15 months of commencing processing, then an annual return; OHL organisations renew their registration annually instead.

The toolkit ships two pure utilities for this regime — classifyDCPMI() and generateComplianceAuditReturn() — plus the useDCPMI and useComplianceAuditReturn hooks. They carry no React dependency, so they run equally well in a Server Action, a route handler, or a scheduled job.

Not legal advice

These utilities compute registration tiers and filing dates from the September 2025 GAID baseline. The NDPC revises classification metrics and extends filing deadlines — always verify against current NDPC guidance before relying on the output. Thresholds, fees, and deadlines are all configurable for this reason.

Classifying a DCPMI

classifyDCPMI() takes the number of distinct data subjects processed in the relevant six-month window and returns the tier, the annual registration fee, and the filing obligations:

import { classifyDCPMI } from '@tantainnovative/ndpr-toolkit/core';

const result = classifyDCPMI({ dataSubjectsInSixMonths: 6200 });

result.tier;                                // "UHL"
result.isDCPMI;                             // true
result.annualFeeNGN;                        // 250000
result.registration.required;              // true
result.registration.renewsAnnually;        // false — UHL/EHL register once, file CAR yearly
result.compliance.auditReturnsAnnual;      // true
result.compliance.initialAuditWithinMonths; // 15
result.dataSubjectsConsidered;             // 6200

Tiers (September 2025 GAID baseline)

Tier	Data subjects / 6 months	Annual fee (₦)	Registration
UHL — Ultra High Level	more than 5,000	250,000	Register once + CAR annually
EHL — Extra High Level	1,000 – 5,000	100,000	Register once + CAR annually
OHL — Ordinary High Level	200 – 999	10,000	Renews annually
below 200	—	—	Not a DCPMI by volume

Boundaries resolve so that the 1,000 mark is EHL (OHL is 200–999) and UHL is strictly greater than 5,000 (5,000 itself is EHL). For an organisation the Commission has separately listed as a DCPMI below the volume tiers, pass { isDesignated: true } — it resolves to the 'listed' tier with a note to confirm the applicable fee with the NDPC.

Overriding thresholds and fees

Treat the defaults as the September 2025 baseline, not a constant. Pass overrides as the metrics evolve:

classifyDCPMI(
  { dataSubjectsInSixMonths: 3000 },
  {
    thresholds: { ohl: 200, ehl: 1000, uhl: 5000 },
    fees: { UHL: 250000, EHL: 100000, OHL: 10000 },
  },
);

Scheduling Compliance Audit Returns

generateComplianceAuditReturn() derives the CAR schedule for a DCPMI: the initial-audit due date (commencement + 15 months) and the next annual filing deadline relative to a reference date. The NDPC baseline deadline is 31 March, filed via the NDPC Information Management Portal (NIMP).

import { generateComplianceAuditReturn } from '@tantainnovative/ndpr-toolkit/core';

const car = generateComplianceAuditReturn({
  commencementDate: '2025-01-15',
  asOf: '2026-03-21',
  tier: 'UHL',
});

car.applicable;                       // true
car.schedule.initialAuditDueDate;     // "2026-04-15"  (commencement + 15 months)
car.schedule.nextFilingDeadline;      // "2026-03-31"
car.schedule.filingYear;              // 2026
car.status.daysUntilNextDeadline;     // 10
car.status.initialAuditDue;           // false
car.notes;                            // GAID/NIMP guidance strings

Once asOf passes the deadline, the schedule rolls to the next year automatically. Omit asOf to evaluate against today, and omit tier to assume the organisation is in scope.

Deadline overrides

NDPC deadlines shift — the 2026 filing was extended to 30 May. Supply per-year overrides so your schedule tracks the current notice:

generateComplianceAuditReturn(
  { commencementDate: '2025-01-15', asOf: '2026-04-01', tier: 'UHL' },
  { deadlineOverrides: { 2026: '2026-05-30' } },
).schedule.nextFilingDeadline;        // "2026-05-30"

React hooks

For client UIs, both utilities ship as memoised hooks from @tantainnovative/ndpr-toolkit/hooks:

import { useDCPMI, useComplianceAuditReturn } from '@tantainnovative/ndpr-toolkit/hooks';

function RegistrationStatus() {
  const dcpmi = useDCPMI({ dataSubjectsInSixMonths: 6200 });
  const car = useComplianceAuditReturn({
    commencementDate: '2025-01-15',
    tier: dcpmi.tier,
  });

  return (
    <dl>
      <dt>Tier</dt><dd>{dcpmi.tier}</dd>
      <dt>Annual fee</dt><dd>₦{dcpmi.annualFeeNGN.toLocaleString()}</dd>
      <dt>Next CAR deadline</dt><dd>{car.schedule.nextFilingDeadline}</dd>
    </dl>
  );
}