Almost every business holds personal data: customer names and phone numbers, staff payroll records, patient files, supplier bank details. The law now says what a business may do with that data and what happens if it loses it. For an auditor this matters twice. The client may be fined for a breach, and the audit firm itself holds client data it must protect.
This topic covers the governing principles of the Nigerian Data Protection Regulation (NDPR) 2019, the risks of hosting data with cloud providers, the NDPR implementation framework (consent, the data protection audit, compliance organisations), and the default and penalty rules. The exam follows the NDPR as Institute of Chartered Accountants of Nigeria (ICAN) teaches it. A short section near the end gives the later change in the law as background.
The previous topics cover governance, risk and compliance (GRC) software and Control Objectives for Information and Related Technologies (COBIT). The next topic returns to ethics and the profession.
In 30 seconds
The National Information Technology Development Agency (NITDA) issued the NDPR in 2019 under its powers in the NITDA Act 2007. Principle 2.1 says personal data must be collected and processed for a specific, legitimate and lawful purpose the data subject has consented to, be adequate and accurate, be stored only as long as reasonably needed, and be secured against foreseeable hazards.
Anyone holding personal data owes the data subject a duty of care and is accountable for what they do and fail to do. An organisation that processes the data of more than 1,000 data subjects in 6 months, or 2,000 in 12 months, must file a data protection audit report with NITDA by 15 March each year, with a verification statement from a licensed data protection compliance organisation (DPCO).
A breach must be reported to NITDA, within 72 hours of knowing. The fine is 1% of the previous year’s gross revenue or ₦2,000,000, whichever is greater, where fewer than 10,000 data subjects are involved, and 2% or ₦10,000,000, whichever is greater, where more than 10,000 are involved.
Under Companies and Allied Matters Act 2020 (CAMA 2020), the records duty in section 374, the audit committee’s review of controls in section 404(7)(d), the chief executive officer (CEO) and chief financial officer (CFO) certification in section 405 and the auditor’s right of access in section 407(3) all sit alongside these rules.
CAMA 2020 and data protection
CAMA 2020 is not a data protection law. It does not mention the NDPR. The Act and the NDPR meet because a company must keep records, and many of them hold personal data.
| Provision | What it says | Link to data protection |
|---|---|---|
| s. 374(1) | Every company must cause accounting records to be kept | Payroll, customer and supplier records hold personal data. The NDPR says data is to be stored only as long as it is reasonably needed, so the company must set retention periods that meet both the accounting records duty and the NDPR |
| s. 404(7)(a) and (d) | The audit committee checks that accounting and reporting policies follow legal requirements and keeps the system of accounting and internal control under review | Data protection is a legal requirement, and security of personal data is part of internal control |
| s. 405 | The CEO and CFO of a company other than a small company certify that they are responsible for establishing and maintaining internal controls | Controls over personal data are part of what they are certifying |
| s. 407(3) | The auditor has a right of access at all times to the company’s books, accounts and vouchers | This gives the audit firm access to personal data, so the firm takes on a duty of care for it under the NDPR principles |
Sections 404(7), 405 and 407(3) are also covered in the earlier topic on communication with those charged with governance.
Governing principles of data processing
NITDA issued the NDPR in 2019 using the powers it has under the NITDA Act 2007. Principle 2.1 sets out the governing principles. The regulation says personal data shall be:
- Collected and processed for a purpose. The purpose must be specific, legitimate and lawful, and the data subject must have consented to it. Further processing is allowed only for archiving, scientific research, historical research or statistical purposes in the public interest. Anyone processing data under this exception shall not transfer personal data to any person.
- Adequate and accurate. The data must also be without prejudice to the dignity of the human person.
- Stored only for the period within which it is reasonably needed.
- Secured against all foreseeable hazards and breaches. These include theft, cyber-attack, viral attack, dissemination, manipulation of any kind, and damage by rain, fire or other natural elements.
Two further principles follow. Anyone entrusted with, or in possession of, the personal data of a data subject owes that data subject a duty of care. They are also accountable for their acts and omissions in processing, in line with the principles in the regulation.
Data privacy and security risks in the cloud
Storing confidential data with a cloud provider hands over a large part of the control of its security. Three risks stand out.
| Risk | What to do |
|---|---|
| Data privacy and security risk | Make sure the vendor understands your privacy and security needs, and the rules that apply to your entity, such as the NDPR or the General Data Protection Regulation (GDPR) and the Payment Card Industry Data Security Standard (PCI DSS) |
| Data availability and business continuity risk | Ask what controls keep internet connectivity running. If a weakness is found you may have to cut off all access to the provider until it is fixed. A law enforcement agency that seizes a shared server can also interrupt unrelated services stored on the same machine |
| Record retention requirements risk | If your business must retain records for a set period, make sure the provider knows and meets those rules |
The NDPR implementation framework
Why the NDPR matters
The NDPR raised awareness of data protection and privacy in Nigeria and set rules for collecting and processing data. Earlier rules were vague and weak at imposing sanctions. NITDA has since issued non-compliance notices to defaulting companies, including banks, telecoms companies and government agencies. Compliance builds trust between a business and its customers, and avoids costly fines, litigation, public embarrassment and a bad reputation.
Consent
Data controllers and processors must first get the data subject’s consent, free of undue influence, fraud and coercion. Consent is usually obtained through a clear, unambiguous data privacy policy that the data subject agrees to.
The data protection audit
Every organisation that processes the personal data of more than 1,000 data subjects in 6 months or 2,000 data subjects in 12 months must submit a data protection audit report to NITDA not later than 15 March every year. The audit is the organisation’s own check of its privacy and data protection practices, and it is meant to show that the controller or processor complies with the law. The report states:
- the data collected on employees and members of the public;
- the purpose for which the data is collected;
- the notice given to individuals about collection and use of their data;
- the access individuals have to review, amend, correct, supplement or delete their data;
- whether consent was obtained before the data was collected, used, transferred or disclosed, and how;
- the policies and practices for proper use and security of the data;
- the policies and procedures for privacy and data protection; and
- the policies and procedures for assessing the impact of technologies on those privacy and security policies.
Controllers should also audit the contracts with third-party processors that receive personal data. Compliance is not a one-off duty. It is a continuing activity, and failure to file the returns is a breach of the NDPR. A complete audit aligns all the company’s processes so that data is handled without harming its integrity or the privacy of its owners.
Every data audit report must come with a verification statement from a DPCO.
Data protection compliance organisations (DPCOs)
DPCOs are licensed professionals who provide audit and compliance services to data controllers. Law firms, consultancies, information technology (IT) service providers and audit firms may be licensed by NITDA if they have the right credentials.
ICAN lists data protection certification or experience in data science, data protection and privacy, information privacy, information audit, data management, information security, data protection legal services, IT due diligence, European Union (EU) GDPR implementation and compliance, cyber-security and cyber-security law, data analytics and data governance.
Their services are a data protection compliance audit, data protection and privacy training, advisory services, drafting regulation contracts and data protection impact assessments.
Default and penalties
A data breach is an accidental or unlawful incident that exposes confidential or protected information, or that results in the loss or theft of customers’ personal details. Non-compliance with the NDPR is also a breach. NITDA must be told of a breach immediately, and the report must be made within 72 hours of knowing about it.
| Data subjects dealt with | Fine |
|---|---|
| Fewer than 10,000 | 1% of the previous year’s annual gross revenue or ₦2,000,000, whichever is greater |
| More than 10,000 | 2% of the previous year’s annual gross revenue or ₦10,000,000, whichever is greater |
If the controller reports the breach itself, that is a major factor in setting the amount of the fine.
Background: the later change in the law
This section is background from outside the ICAN syllabus. For the exam, write the answer on the NDPR as ICAN teaches it, and add this only if the question asks about the current position.
- The Nigeria Data Protection Act 2023 (NDPA) took effect in June 2023 and created the Nigeria Data Protection Commission (NDPC) as the data protection regulator.
- On 20 March 2025 the NDPC issued the General Application and Implementation Directive (GAID) 2025 to guide the NDPA. Commentators report that the GAID took effect on 19 September 2025.
- Article 3(3) of the GAID says the NDPC will cease to apply the NDPR 2019 as a legal instrument for regulating data privacy. Many firms describe this as a repeal. At least one legal commentator argues it is an administrative decision and not a formal repeal.
For a student the safe line is: the NDPR set the rules taught for the exam, and the NDPA 2023, applied with the GAID 2025, is now the main framework.
The rules in more depth
Why the two thresholds
A small clinic with a few hundred patients does not need a full annual audit. A bank with millions of customers does. The thresholds (1,000 in 6 months, 2,000 in 12 months) draw the line by the volume of personal data handled, and the time windows catch both a burst of activity and steady activity.
Breach and non-compliance are different events
A breach is an incident, such as a hack or lost laptop. Failing to file the audit report or to get consent is non-compliance. The NDPR treats both as breaches, so both can lead to a fine.
Why self-reporting matters
The regulator rewards a controller who reports its own breach. A controller that hides a breach, or reports late, loses that credit and faces the full fine. The 72-hour clock runs from the time the controller knows, not from the time the breach happened.
Where the audit firm fits
An audit firm may be licensed as a DPCO. If it acts as DPCO for a client it also audits, it risks a self-review threat, because it would later audit controls it helped to design or verify. The earlier topic on non-audit services explains how to judge that threat. This is an application of the ethics rules to the data protection setting, not a rule stated in the regulation.
Worked example: a breach at a payments company
Scenario. Pelumi Pay Ltd processes the personal data of 15,000 customers. Its gross revenue in the previous year was ₦900,000,000. A hacker takes customer records. The company learns of the breach on Monday and reports it to NITDA on Thursday of the same week, which is 72 hours later. A second company, Mini Stores Ltd, deals with 6,000 data subjects and has previous-year revenue of ₦150,000,000.
Calculate the penalty range for each, and say whether each must file a data protection audit report. The figures are illustrative.
- Pelumi Pay. It deals with more than 10,000 data subjects, so the fine is 2% of previous-year gross revenue or ₦10,000,000, whichever is greater. 2% of ₦900,000,000 is ₦18,000,000. That is more than ₦10,000,000, so the fine is ₦18,000,000.
- Self-reporting. The company reported within the 72-hour limit. That counts in its favour when NITDA sets the final amount, although the regulation gives the rate and the floor, not a set discount.
- Mini Stores. It deals with fewer than 10,000 data subjects, so the fine is 1% of previous-year gross revenue or ₦2,000,000, whichever is greater. 1% of ₦150,000,000 is ₦1,500,000. That is less than ₦2,000,000, so the fine is ₦2,000,000.
- Audit report. Suppose Mini Stores handled the data of 1,200 customers in the last 6 months. That is more than 1,000 in 6 months, so it must file a data protection audit report with NITDA by 15 March, with a DPCO verification statement. If it handled fewer than 1,000 in 6 months and fewer than 2,000 in 12 months, the filing duty would not arise.
- CAMA 2020. For both companies, the audit committee under section 404(7)(d) should review whether controls over personal data are effective, and the auditor’s right of access under section 407(3) comes with a duty to protect the data it sees.
How to score full marks
- Learn the numbers. 1,000 in 6 months, 2,000 in 12 months, 15 March, 72 hours, 1% and ₦2,000,000, 2% and ₦10,000,000, 10,000 data subjects. Examiners test these.
- State “whichever is greater”. The fine is the higher of the percentage and the fixed sum. Compute both and pick the larger.
- Use the four principles as headings. Purpose and consent, adequate and accurate, storage limitation, security. Add duty of care and accountability for the last marks.
- List the audit report contents in groups. Data collected, purpose, notice, access rights, consent, policies, procedures, impact of technology.
- Link to the auditor. Mention that an audit firm may be a DPCO and that independence must then be considered.
- Label the update. If you mention the NDPA 2023 and GAID 2025, say it is the later position and still give the NDPR answer.
Common mistakes in the exam
- Writing the penalty as only a percentage, and forgetting the fixed minimum.
- Mixing up the two tiers, for example 2% for fewer than 10,000 data subjects.
- Saying the data protection audit report goes to the Corporate Affairs Commission (CAC) or the Financial Reporting Council of Nigeria (FRC). It goes to NITDA.
- Forgetting the DPCO verification statement.
- Saying a breach must be reported within 7 days. The NDPR says 72 hours.
- Treating consent as a tick-box. It must be free of undue influence, fraud and coercion, and given to a clear policy.
- Saying CAMA 2020 contains the data protection rules. It does not.
Quick revision
- NDPR 2019: issued by NITDA under the NITDA Act 2007.
- Principle 2.1: purpose with consent, adequate and accurate, stored only as long as needed, secured. Duty of care. Accountability.
- Cloud risks: privacy and security, availability and continuity, record retention.
- Consent: free of undue influence, fraud and coercion.
- Audit: more than 1,000 data subjects in 6 months or 2,000 in 12 months. File with NITDA by 15 March. DPCO verification statement.
- Breach: notify NITDA, within 72 hours. Self-reporting counts in the controller’s favour.
- Fines: fewer than 10,000 data subjects, 1% or ₦2,000,000; more than 10,000, 2% or ₦10,000,000; whichever is greater.
- Background: NDPA 2023 and GAID 2025.
- CAMA 2020: s. 374 records, s. 404(7)(a) and (d), s. 405, s. 407(3).
Practice questions
These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.
Recall check: multiple choice
The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.
Question 1. The Nigerian Data Protection Regulation 2019 was issued by:
- The Corporate Affairs Commission
- The National Information Technology Development Agency (NITDA)
- The Financial Reporting Council
- The Central Bank of Nigeria
Show the answer
B. It was made under NITDA’s powers in the NITDA Act 2007.
Question 2. Under the NDPR, personal data must be stored:
- For as long as the company wishes
- Forever
- Only for the period within which it is reasonably needed
- For exactly one year
Show the answer
C. This is the storage limitation principle.
Question 3. A person who holds the personal data of a data subject owes that data subject:
- A duty of care
- No duty
- A duty to sell the data
- A duty to publish the data
Show the answer
A. They are also accountable for their acts and omissions in processing.
Question 4. An organisation must file a data protection audit report with NITDA if it processes the data of more than:
- 100 data subjects in 6 months
- 500 data subjects in 3 months
- 5,000 data subjects in 12 months
- 1,000 data subjects in 6 months
Show the answer
D. The other trigger is 2,000 data subjects in 12 months.
Question 5. The data protection audit report is due not later than:
- 31 December
- 15 March
- 30 June
- 1 January
Show the answer
B. It is an annual filing.
Question 6. Every data audit report must be accompanied by a verification statement from:
- The audit committee
- The company secretary
- A licensed data protection compliance organisation (DPCO)
- The stock exchange
Show the answer
C. Audit firms may be licensed as DPCOs if they meet NITDA’s conditions.
Question 7. A breach should be reported to NITDA within:
- 72 hours of knowing of it
- 7 days
- 30 days
- One year
Show the answer
A. Self-reporting is a major factor in setting the fine.
Question 8. For a controller dealing with fewer than 10,000 data subjects, the fine is:
- 0.5% of revenue or ₦500,000
- 2% of revenue or ₦10,000,000
- 5% of revenue
- 1% of the previous year’s gross revenue or ₦2,000,000, whichever is greater
Show the answer
D. The higher tier applies where more than 10,000 data subjects are involved.
Question 9. Which of the following is a risk of hosting data with a cloud provider?
- Lower electricity costs
- A smaller office
- Loss of internet connectivity affecting business continuity
- Fewer staff
Show the answer
C. Others are data privacy and security, and record retention requirements.
Question 10. Which provision of CAMA 2020 requires the CEO and CFO of a company, other than a small company, to certify that they are responsible for internal controls?
- Section 404
- Section 405
- Section 406
- Section 407
Show the answer
B. Section 406 is improper influence and section 407 is the auditor’s duties and powers.
Written questions
Question 11 (10 marks). State the governing principles of data processing under the Nigerian Data Protection Regulation 2019 and the duties of anyone entrusted with personal data.
Question 12 (20 marks). (a) Explain the requirement for a data protection audit under the NDPR, including who must file, when and what the report states. (7 marks) (b) Explain the role of a data protection compliance organisation (DPCO), who may be licensed, and the services it provides. (7 marks) (c) Explain what is a data breach, how it must be reported and the penalties under the NDPR. (6 marks)
Question 13 (10 marks). Eko Logistics Ltd stores the personal data of its customers with a cloud provider. In the last 6 months it processed the data of 1,500 customers. (a) Identify the risks of hosting confidential data with a cloud provider and how the company can address them. (5 marks) (b) State the steps the company must take to comply with the NDPR. (5 marks)
Model answers
Show the model answer to Question 11
Principles (8 marks, 2 each). Personal data shall be collected and processed for a specific, legitimate and lawful purpose to which the data subject has consented. Further processing is allowed only for archiving, scientific or historical research or statistical purposes in the public interest. (2) It shall be adequate and accurate, and without prejudice to the dignity of the human person.
(2) It shall be stored only for the period in which it is reasonably needed. (2) It shall be secured against all foreseeable hazards and breaches, such as theft, cyber-attack, viral attack, dissemination, manipulation, and damage by rain, fire or other natural elements. (2)
Duties (2 marks). Anyone entrusted with, or in possession of, a data subject’s personal data owes the data subject a duty of care. (1) They are accountable for their acts and omissions in data processing, in line with the principles of the regulation. (1)
Show the model answer to Question 12
(a) Data protection audit (7 marks). An organisation that processes the personal data of more than 1,000 data subjects in 6 months must file. (1) So must one that processes the data of 2,000 data subjects in 12 months. (1) The report goes to NITDA not later than 15 March every year.
(1) It states the data collected on employees and the public, the purpose, the notice given to individuals, the access individuals have to review, correct or delete their data, whether and how consent was obtained, the policies and practices for use and security of the data, the policies and procedures for privacy and data protection, and the policies for assessing the impact of technologies. (1 each for any four)
(b) DPCOs (7 marks). A DPCO is a licensed professional that provides audit and compliance services to data controllers. (1) Law firms, consultancies, IT service providers and audit firms may be licensed by NITDA if they have the right credentials. (1) Examples of credentials are data protection certification or experience, information privacy, information audit, information security and cyber-security law.
(1 for any one more) Services include a data protection compliance audit, training, advisory services, drafting regulation contracts and data protection impact assessments. (1 each for any three) Each data audit report must have a DPCO verification statement. (1)
(c) Breach and penalties (6 marks). A data breach is an accidental or unlawful incident that exposes confidential or protected information or results in the loss or theft of customers’ personal details. Non-compliance with the NDPR is also a breach. (1) NITDA must be told immediately, and the report must be made within 72 hours of knowing.
(1.5) Where the controller deals with fewer than 10,000 data subjects, the fine is 1% of the previous year’s annual gross revenue or ₦2,000,000, whichever is greater. (1.5) Where the controller deals with more than 10,000 data subjects, the fine is 2% of that revenue or ₦10,000,000, whichever is greater. (1.5) Self-reporting of the breach is a major factor in setting the fine. (0.5)
Show the model answer to Question 13
(a) Cloud risks (5 marks). Data privacy and security risk: the company hands over much of its control over security, so it should make sure the vendor understands its needs and the rules that apply, such as the NDPR, the GDPR and PCI DSS.
(1.5) Data availability and business continuity risk: loss of internet connectivity, or a vulnerability, can stop access, so it should ask what controls keep connectivity running and have a plan for cutting access. (1.5) Record retention risk: it should make sure the provider understands and meets any retention rules. (1) It should also write these duties into the contract with the provider and audit the third-party processor contract, as the NDPR framework advises. (1)
(b) Compliance steps (5 marks). Get the consent of each customer, free of undue influence, fraud and coercion, through a clear data privacy policy. (1.5) Because it processed the data of 1,500 customers in 6 months, which is more than 1,000, it must file a data protection audit report with NITDA. (1.5) The filing is due not later than 15 March each year. (1) The report must come with a verification statement from a licensed DPCO. (1)
Pathfinder on data protection and the NDPR
These are the ICAN Pathfinder questions that test this topic. ICAN owns the questions and the suggested solutions, so we point you to them and do not copy them. Open your Pathfinder, attempt each question under exam conditions, then check your answer against the notes above.
The solution to this part names data privacy and confidentiality, with risks of unauthorised access, data breaches and misuse of confidential information. The principles of data processing and the breach rules in this topic support that point and give the language to expand it.
Revise first: Governing principles of data processing
No question in the two diets asks about the NDPR directly. A fintech that processes personal data at that scale is the kind of client where a breach, a fine and the audit firm’s own duty to protect data would be examined, so expect the principles and penalties to appear inside a wider answer.
Revise first: The NDPR implementation framework
Source: ICAN Pathfinder, Advanced Audit, Assurance and Forensics. Diets covered: May Diet, 2026 and November Diet, 2025.
Spotted a mistake? Tell us and we will check it.
