Frameworks · NDPA 2023 · native
The only one of the twenty-three that is actually the law
Everything else on Asiri is a mapping. The Act is the thing you answer to — a register set, three clocks and a standard with no clock at all, and one annual return signed by a licensed DPCO.
Your compliance year
CAR-2026 · in progressRegisters reviewed and owners confirmed
Nobody who left the company still owns a register. This is the month that check happens.
Audit scope agreed with your DPCO
A licensed firm reads your registers and agrees what will be tested — before anyone is paid.
Fieldwork and client responses
Findings need a reply. Silence is recorded as no response received and disclosed in the opinion.
Annual return due
The statutory deadline. The 2025 year was extended by 60 days to 30 May 2026 — an extension, not a new date.
Acknowledgement from the Commission
Answered is not honoured. The pack is not closed until the acknowledgement lands.
Three clocks and a standard running underneath
Breaches, requests, grievances. None of them wait for filing season, and the one with no period does not wait either.
Three statutory clocks, and one standard
The Act keeps time whether you do or not
Each of these starts on an event, not on a decision. Asiri starts them from the record and shows how much is left — the bar under each card is how far it has run. The fourth card has no bar because the Act gives it no period, which is a fact about the law and not a gap in the page.
72
hours · s. 40
Breach notification
From the moment anyone here becomes aware — not from when the investigation finishes. Half-logged is still logged.
Without undue delay
ss. 34, 38 · no period set
Data subject request
A person asks what you hold, and the duty runs from receipt — including the request that landed in a shared inbox. It runs to no fixed day: the Act names none and the Commission has prescribed none, so a schedule is not a defence and answering sooner than one may still be undue delay.
14
days · grievances
Grievance acknowledgement
Acknowledging is not resolving, and the Act counts both separately.
365
days · s. 28
Annual audit return
Prepared and signed by a licensed DPCO if you are a controller of major importance.
What the return is made of
Twenty-three registers, and the return reads all of them
These are not tabs in a spreadsheet. Each one is a live record with owners, dates and provenance — and the filing pack fails loudly when one of them is empty rather than filing a blank.
- 01Processing activities
- 02Lawful basis
- 03Consent events
- 04Data subject requests
- 05Grievances
- 06Policies
- 07Children and age checks
- 08Processors and suppliers
- 09Cross-border transfers
- 10People and roles
- 11Security measures
- 12Retention schedule
- 13Incidents
- 14DPIAs and assessments
- 15Findings
- 16Evidence
- 17Regulator correspondence
- 18DPO appointment
- 19NDPC registration
- 20Audit engagements
- 21Training
- 22Systems
- 23Third-party contracts
Who may sign it
Not you, if you are a controller of major importance
The return is prepared and signed by a licensed DPCO. The Commission publishes no interface, so a person reads the licence off the NDPC portal and Asiri keeps the capture and the date — a firm whose licence lapses mid-engagement cannot file, at any price.
Ultra high level
You cannot file alone
A licensed DPCO prepares and signs. Registration ₦250,000, filing fee ₦500,000 to ₦1m, by data subject count (Schedule 10).
Extra high level
You cannot file alone
Same rule. Registration ₦100,000, filing fee ₦100,000 to ₦250,000, by data subject count (Schedule 10).
Ordinary high level
Nothing to sign
No annual return is due at this level — Art. 9(3) asks you to renew the registration every year in its place, and the registers are still required. Registration is ₦10,000, renewed every year.
Section 48 · the arithmetic
The floor is irrelevant to almost everybody
The Act sets a remedial fee as the greater of a fixed floor and a percentage of last year's gross revenue. At ₦7.65bn of turnover the percentage is fifteen times the floor — so the percentage is the only number that matters.
The floor · DCMI
₦10m
2% of turnover
₦153m
MultiChoice, 2024
₦766m
Fidelity Bank, 2024
₦555m
Start the year properly, not in March
Connect one system and Asiri fills what it can read, names what it cannot, and tells you which of the two is the bigger problem.