Your registration with the Nigeria Data Protection Commission records your controller tier, and the tier decides whether you owe an annual return and who may file it. Record the registration first. Until it is recorded, Asiri cannot say whether a return is owed.
Who can do this
An owner or editor of your workspace can record the registration. A firm you have engaged for filing can do the same. Other members can see both pages.
Registering with the Commission is your own act, done under your appointed data protection officer. Asiri keeps the record of it. Recording is refused if your workspace has no data protection officer appointed. You may also be asked to confirm it is you before the record is saved.
Find the pages
Open Programmes and open your NDPA programme. Under Workspace records, choose NDPC registration or Annual return & filing.
Record the registration
On NDPC registration, the strip at the top shows Status, Tier, Reference and Renews. If nothing is recorded yet, press Record the registration. There are three steps.
- Controller tier: choose Ultra-high level, Extra-high level or Ordinary-high level, the tier the Commission registered you at. Say Why this tier applies. This is required.
- Registration details: the Commission reference, the fee paid in naira, the date you registered and the date it renews. Each is optional, so leave out what you do not have yet.
- Review and confirm: optionally, the number of data subjects. If you give a count, explain How that count was reached. The count sets the filing fee.
Press Record NDPC registration. Press Refresh registration to read the record again.
Read the annual return
Annual return & filing shows what your tier means for the return.
- No annual return is owed: at ordinary-high level, the yearly registration renewal takes the place of the return. The exemption holds only if the renewal is actually made.
- A licensed firm files it: at ultra-high and extra-high level, the return goes to the Commission through a licensed data protection compliance organisation. You can have everything ready, but the firm makes the submission. Press Find a licensed firm to look for one.
- Nobody has established whether you owe one: no registration is recorded, so no tier is. This is not the same as owing nothing.
Where a return is owed, the page counts the days to the deadline. A company established before 12 June 2023 files by 31 March each year. One established after that date files its first return fifteen months after it was established.
Ready to file
The return reports what your registers say, so each section links to the register behind it, such as A record of everything you do with data, A lawful reason for each one and Breaches, and whether you told the Commission. Nothing on this page is typed in for the filing. To improve the return, improve the register.
Each section shows one of these states:
- All entries complete, or Nothing recorded. An empty register is a true answer.
- Some entries still open. The return cannot be completed past them.
- Nothing examines it. Nothing checks this register for gaps, so a clean reading would mean nobody looked.
Ready to file counts sections, not rows, so one large register cannot hide a weak one.
Fees, letters and past filings
- What it costs shows the fee, banded by tier and by how many people's data you held. It can be nothing. The fee is paid to the Commission, never to Asiri.
- Why it applies to you shows your tier and when you registered. Press Open the registration to change it.
- Letters about it links to Regulator correspondence. A late return is an offence in its own right.
- Everything you have filed lists the returns recorded so far and whether each was acknowledged.
Common questions
"Does Asiri file the return with the Commission?" No. The page shows what the return will report and how ready it is. At ultra-high and extra-high level the licensed firm submits it.
"We have not registered yet. Do we owe a return?" Nobody can say until the tier is known. Register, then record it here.
"Why does the count of data subjects matter?" It sets the band, and so the fee. Explain how you reached it, because the Commission may ask.