NDPC compliance for foreign companies can apply even when a business has no office, employees or servers in Nigeria. If your company processes personal data about individuals in Nigeria, you need to assess its duties under the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Commission’s implementing requirements.
Start by establishing your processing role, registration obligations, compliance responsibilities and international data flows. An existing GDPR programme can provide useful evidence, but it does not establish compliance with Nigerian law.
Start the 6030 Technologies NDPA compliance assessment to identify the obligations that apply to your foreign entity and its Nigerian-facing services.
NDPC compliance for foreign companies without a Nigerian office
Section 2(2)(c) of the NDPA covers a controller or processor outside Nigeria that processes personal data of a data subject in Nigeria. The relevant connection is the processing of information about individuals in Nigeria; local incorporation is not a prerequisite for that provision to apply.
The General Application and Implementation Directive 2025 (GAID) explains how these duties apply. Article 1 addresses overseas processing, while article 8(2) says that operating in Nigeria includes targeting data subjects in Nigeria when assessing major-importance status.
This matters to overseas software providers, online platforms, outsourcing companies and other businesses handling customer, employee or user records connected with Nigerian operations. Review the actual data flows and applicable exemptions. A contract signed abroad or a server hosted elsewhere does not, by itself, resolve the jurisdiction question.
Establish your role for each processing activity
A controller determines why and how personal data is processed. A processor handles it on behalf of, or under the direction of, a controller or another processor. These roles come from section 65 of the NDPA.
For example, an overseas customer-support platform may process service tickets for a Nigerian business on that business’s instructions. It may separately act as controller for its own billing contacts or recruitment records. Document each activity rather than assigning one label to the whole organisation.
Processors have compliance obligations of their own. Under section 29, organisations engaging processors must also ensure that those providers meet the applicable requirements. Expect Nigerian customers to request evidence about your registration status, safeguards, contracts and handling of subcontractors.
Determine whether NDPC registration is required
Section 44 requires registration by data controllers and data processors of major importance, often shortened to DCPMIs. Falling within the NDPA’s scope and qualifying for registration are separate questions.
The NDPC registration guidance considers processing volume, specified sectors, commercial ICT activities and other designation criteria. Its classification rules also address sensitivity, substantial cloud processing and cross-border data flows. The guidance expressly includes multinational companies in the Ultra-High Level category.
Assess your entity against those rules before selecting Ultra-High Level (UHL), Extra-High Level (EHL) or Ordinary-High Level (OHL). Processing data for a bank does not automatically make a software supplier a bank; classify the supplier by its own activities and the applicable criteria.
Prepare an accurate registration submission covering the information required by section 44, including your organisation and DPO details, processing purposes, data categories, recipients, transfer destinations and safeguards. Confirm the current supporting-document requirements for an overseas applicant before filing.
Appoint the DPO and confirm local representation arrangements
GAID article 7 requires controllers and processors of major importance to designate a Data Protection Officer (DPO). Articles 11–14 address appointment, independence, reporting and credential assessment. Publish the DPO’s contact details and communicate them to the NDPC in the prescribed form.
The DPO can be an employee or work under a service contract. The role needs sufficient expertise, resources and access to management. Assign responsibility for monitoring Nigerian requirements and handling requests from individuals and the regulator.
Local representation serves a different purpose: receiving correspondence and coordinating regulatory engagement for the overseas entity. Confirm any separate local-representative requirement with the NDPC for your filing. Where required, keep the appointment letter, scope of authority, Nigerian contact details and evidence of the appointment in the submission record.
One provider may perform both roles, but document what each appointment authorises. Section 44 lists registration details about processors and their representatives; confirm any further filing-specific requirement rather than treating that provision alone as a blanket appointment duty for every foreign company.
Adapt existing privacy controls to Nigerian requirements
Start with a gap assessment of your existing programme. Policies prepared for another jurisdiction may already address access control, retention and incident handling. Check their substance against the NDPA and GAID, then update the procedures staff actually use.
- Map each processing purpose to a lawful basis under section 25, with any additional conditions for sensitive personal data.
- Update privacy notices to explain Nigerian rights, relevant contacts, recipients, retention and the NDPC complaints route.
- Review processing agreements for instructions, responsibilities, security, confidentiality, subcontracting and assistance with requests.
- Maintain a record of processing activities (RoPA) showing the Nigerian data flows, systems, recipients and retention arrangements.
- Test access restrictions, deletion procedures and incident escalation, and retain evidence of staff training.
NDPA sections 25–29 and GAID article 34 provide the legal basis for several of these checks. Consent is one lawful basis; do not add consent forms indiscriminately where another basis properly applies.
Document cloud processing and cross-border transfers
Map where personal data is collected, stored, backed up, accessed and shared. Include cloud providers, support teams and subprocessors. A hosting-region label alone will not show every destination or recipient.
Sections 41–43 of the NDPA govern transfers from Nigeria to another country. They require an applicable transfer route and records of the basis and adequacy of protection.
GAID Schedule 5 describes adequacy decisions, transfer instruments approved by the NDPC and other recognised grounds. Instruments can include standard contractual clauses, binding corporate rules, codes of conduct or certification mechanisms. Section 43 also provides specific alternative grounds, subject to its conditions.
Review existing GDPR transfer clauses for Nigerian requirements. Their use for European transfers does not automatically establish an approved Nigerian transfer route. Record the destinations, safeguards and any necessary NDPC approval, and check applicable sector rules.
Assess DPIA requirements alongside this work. Section 28 requires a data privacy impact assessment before processing likely to create high risks, and GAID article 28 lists additional specified activities, including cross-border transfers. Check the directive’s assessment and submission requirements.
Prepare a practical registration evidence pack
Gather the following material for the assessment and filing process. This is a preparation checklist; confirm which documents the current portal or NDPC reviewer requires for your entity.
| Material to prepare | What it establishes |
|---|---|
| Home-country incorporation documents, registered address and authorised-signatory details | The legal entity applying and who can act for it. |
| Descriptions of Nigerian-facing services, customers and processing roles | The activities and relationships being assessed. |
| Data categories, volumes, processing records and a flow map | The basis for classification and the scope of compliance work. |
| Cloud-provider and subprocessor lists, locations and transfer safeguards | Where information goes and how each relevant transfer is supported. |
| Privacy notices, processing agreements, retention rules, security evidence and a breach plan | How the organisation meets its substantive duties. |
| DPO appointment and notification records; representative evidence where required | Who is responsible for compliance and regulatory contact. |
Resolve inconsistencies before submission. Your contracts, flow map, privacy notice and portal answers should describe the same processing. Keep a record of regulatory queries and the responses provided.
Keep registration, reporting and breach response current
Registration is one part of ongoing compliance. Under GAID articles 9–10, UHL and EHL entities register once and file annual Compliance Audit Returns (CAR), normally through a licensed DPCO. OHL entities renew registration annually and are not required to file annual CAR when that renewal is completed.
For entities subject to CAR filing, check the 31 March annual deadline and the initial filing provisions for organisations established after 12 June 2023. Article 10(8) provides an initial period of up to 15 months after establishment for those organisations. Notify the NDPC of significant changes to registration information within 60 days, as section 44(3) requires.
Maintain the internal compliance work too: GAID provides for semi-annual DPO reports to management, periodic audits and staff training. Review changes to services, subprocessors and transfer destinations as they occur.
Breach duties depend on your role. Under section 40, a processor must notify the controller or processor that engaged it when it becomes aware of a breach. A controller must notify the NDPC within 72 hours of awareness where the breach is likely to risk individuals’ rights and freedoms. High-risk breaches require immediate communication to affected individuals, subject to the Act’s communication provisions.
Set escalation arrangements that work across time zones. A processor must alert its customer on becoming aware of the breach, so the customer has time to assess and meet its own reporting duties.
Frequently asked questions
Can an overseas processor be covered without selling directly to Nigerian consumers?
Yes. Processing information about individuals in Nigeria for a business customer can bring a foreign processor within section 2(2)(c). Assess the actual processing and exemptions.
Does GDPR compliance remove the need for an NDPA assessment?
No. Reuse suitable controls and evidence, then check Nigerian requirements for registration, notices, contracts, rights, transfers and reporting.
Does a Nigerian customer’s registration cover its foreign supplier?
No. The supplier must assess its own processing role and registration obligations. A customer’s registration does not register a separate legal entity.
Must all personal data stay in Nigeria?
The NDPA provides routes for international transfers. Assess those routes, GAID requirements and any applicable sector restrictions before selecting hosting and access arrangements.
Plan your Nigerian compliance work with 6030 Technologies
6030 Technologies provides NDPA gap assessments, classification and registration support, privacy documentation, DPO services, training and CAR filing support. For an overseas business, the assessment can start with existing policies, contracts and processing records to identify the Nigeria-specific work required.
Complete the NDPC/NDPA compliance assessment with details of your foreign entity, Nigerian-facing services and data flows. You can also email info@6030technologies.com or call +2349037692946.