Nigeria's NDPC Compliance Audit Returns Deadline Passes as GAID Enforcement Begins
Nigeria's data regulator extended its 2025 audit-return filing deadline to 30 May 2026. With the window now closed, late filers face penalties under the GAID and the Data Protection Act 2023.
What Changed
On 30 May 2026, the extended deadline for filing 2025 Compliance Audit Returns (CARs) with the Nigeria Data Protection Commission (NDPC) closed. The Commission had shifted the original 31 March 2026 date to 30 May following widely reported filing notices. CARs are mandated by the Nigeria Data Protection Act (NDPA) 2023 and its General Application and Implementation Directive (GAID), issued 20 March 2025, which repealed the 2019 NDPR and, with the Act, now forms the operative basis for data-protection enforcement. Data controllers and processors of major importance must file through a licensed Data Protection Compliance Organisation via the NDPC portal. Late filing attracts a penalty of 50 percent of the filing fee on top of the standard fee, with further sanctions available.
Who It Affects
Data controllers and processors of major importance operating in Nigeria, including banks, fintechs, telcos, insurers, and any organisation processing large volumes of Nigerian personal data. Foreign entities processing data of Nigerian residents fall in scope regardless of where they sit. With the transition period over, the GAID is now a live enforcement instrument rather than guidance, and the audit-return regime becomes the primary lens through which the NDPC measures accountability.
What to Do
If you missed the 30 May window, file the outstanding CAR immediately through a licensed DPCO and budget for the 50 percent late-filing penalty on top of the standard fee. Confirm whether your organisation qualifies as a controller or processor of major importance under the GAID thresholds, and document consent, retention, and cross-border transfer bases now. Treat the audit return as an annual obligation, not a one-off, and keep verification and data-handling logs audit-ready so the next cycle is a filing exercise, not a scramble.
What is deepidv?
Not everyone loves compliance — but we do. deepidv is the AI-native verification engine and agentic compliance suite built from scratch. No third-party APIs, no legacy stack. We verify users across 211+ countries in under 150 milliseconds.
Learn More