NDPC Signals the Era of Verifiable Accountability in Nigeria’s Data Economy

In the 2026 digital economy, privacy is no longer a luxury—it is a competitive moat. However, for many Nigerian organizations, “Accountability” remains an abstract concept. Today, April 10, 2026, the NDPC concluded the third edition of its IMPACT (Important Privacy Action Trends) initiative, delivering a clear message to 462 industry leaders: The Compliance Audit Return (CAR) is the scoreboard of the Nigeria Data Protection Act (NDPA).

Under the leadership of the National Commissioner, Dr. Vincent Olatunji, the NDPC is making it clear that filing a CAR is not just a legal requirement—it is a tool for Managing Risk and demonstrating Global Competitiveness.

One of the most significant shifts highlighted in this IMPACT edition is the move toward the Schedule 2 template (NDP Act – GAID). This standardized framework eliminates the “Legal Grey Area” of audits.

• The GAID Alpha: The General Application and Implementation Directive (GAID) 2025 has provided a rigid, structured template for CARs. This ensures that every Data Controller of Major Importance (DCMI) is measured against the same high-fidelity benchmarks for technical and organizational safeguards.

• The DPCO Symbiosis: The initiative emphasized that audits are not a solo journey. Organizations are required to engage Data Protection Compliance Organisations (DPCOs)—licensed intermediaries who act as the “Regulated Auditors” for the commission.

• The Internal Audit Pivot: Beyond the filing, the IMPACT initiative provided practical methodologies for conducting Internal Audits, encouraging organizations to view the CAR as a mirror of their internal data processing health rather than an external chore.

The timing of this IMPACT edition is critical. As of April 2, 2026, the NDPC officially extended the deadline for filing the 2025 Data Protection CAR from March 31 to May 30, 2026.

• The Regulatory Grace: This extension is a strategic move to allow DCMIs to align their frameworks with the new GAID 2025 requirements without facing immediate penalties.

• The Penalty Risk: Failure to utilize this window attracts a penalty of 50% of the applicable filing fee, in addition to heightened regulatory scrutiny.

• The “Tiered” Fee Structure: Under GAID 2025, filing fees are now tiered based on the volume of data subjects—ranging from ₦100,000 for Extra-High Level Tiers to ₦1,000,000 for Ultra-High Level DCMIs processing over 50,000 Nigerians’ data.

The IMPACT initiative featured a robust cross-section of legal and technical expertise, proving that data protection in Nigeria has moved from a “Niche Topic” to a Boardroom Priority.

• Legal Leadership: Representing the NBA-Section on Legal Practice, Tony Krukrubo, SAN, underscored that privacy action is now a core tenet of modern legal practice.

• Global Benchmarking: Insights from Paystack’s Global DPO, Toulu Akerele, highlighted how local CAR filings align with international standards like GDPR, ensuring that Nigerian fintechs remain “Investable” in the global capital market.

• The Privalex Perspective: Confidence Amuda (MD, Privalex Advisory) emphasized that a seamless CAR filing is the ultimate proof of a Mature Compliance Framework, reducing the likelihood of expensive data breach investigations.

The “Compliance vs. Cost” Paradox

• The SME Burden: While CARs are vital for accountability, the tiered filing fees and the cost of engaging a DPCO can be significant for mid-sized firms. The NDPC’s challenge remains ensuring that “Accountability” doesn’t become a “Barrier to Entry” for smaller tech players.

• The Accuracy Risk: Standardized templates reduce friction, but they also risk a “Tick-Box” mentality. The IMPACT initiative’s focus on Internal Audits is a direct play to ensure that CAR filings represent actual security upgrades, not just creative paperwork.

By late 2026, the success of the IMPACT initiative will be measured by the quality of the data in the national Compliance Registry. As Dr. Vincent Olatunji often states, data is the “new oil,” but only if it is handled within a Trust Infrastructure.

The NDPC is drawing a tight circle around data accountability. In the 2026 economy, the “Titan” isn’t the one with the most data—it’s the one who can Prove they are protecting it.

Index Report: NDPC IMPACT (3rd Ed.) Vitals

Sources & References

• NDPC Official (Apr 2026): IMPACT 3rd Edition Highlights – Understanding Compliance Audit Returns

• UUBO (Apr 2, 2026): The NDPC has extended the deadline for filing 2025 Data Protection CAR to 30 May 2026

• Pavestones Legal (Apr 3, 2026): REGULATORY UPDATE: NDPC EXTENDS DATA AUDIT FILING DEADLINE