Penalty calculator · NDPA 2023
What non-compliance is worth, in your own numbers
The Act sets the fee as the greater of a fixed floor and a percentage of last year’s gross revenue — so for most companies the floor never comes into it.
Maximum remedial fee
₦153m
NDPA 2023 §48(4)-(5)
- The floor for your class
- ₦10m
- 2% of last year's gross revenue
- ₦153m
- Whichever is greater
- ₦153m
At your revenue the percentage is the operative number, and the ₦10m floor never comes into it. Each contravention is assessed on its own facts, so these do not simply add — but they do compound the argument.
The plan that carries these obligations costs about 51× less than one ceiling fee — and the fee is not the expensive part. The audit you then have to pass under supervision is.
Late-filing fee not applicable. A year of Asiri on the plan that carries these obligations is ₦3m · Enterprise.
An estimate of the statutory ceiling, not advice. The Commission exercises discretion, weighs cooperation and remediation, and can order compensation or restrictions instead of or alongside a fee. Figures follow NDPA 2023 s. 48 and GAID 2025.
It is not theoretical
The Commission has already done this
Two of the largest sanctions in Nigerian data protection landed on companies with real compliance teams and real budgets. Neither was fined for having no policy — they were fined for what the records showed.
- ₦766m
MultiChoice Nigeria
One of the largest penalties issued under the Nigerian regime, arising from subscriber data handling and cross-border transfer.
- ₦555m
Fidelity Bank
A bank with a compliance function, a DPO and audited controls. The fee still followed, because the record did not support the claim.
- 2%
Of gross revenue, not profit
A loss-making year is no defence. The percentage runs on turnover, which is why the number frightens finance directors more than lawyers.
What actually triggers a fee
Almost never the thing people budget for
01
A late breach notification
The 72 hours run from discovery, and the first person who knew starts them. Four hours late is disclosable; an unexplained gap is not.
02
A request answered but not honoured
Someone objects to a decision, gets a polite reply, and the model keeps declining them. “We answered it” and “we honoured it” are different claims.
03
A supplier with nothing signed
Written terms are a precondition of the disclosure, not paperwork you catch up on. A collections agency taking a monthly arrears file by email is the classic case.
04
Consent that was never really given
Or withdrawal that never reached the sending system. Both are visible in the logs the Commission will ask for.
05
Monitoring nobody was told about
3,100 agents with device monitoring and no disclosure is not a policy problem — it is an ongoing contravention affecting a named population.
06
No return, or one nobody could file
If your firm's licence lapses before the return is signed, you have no auditor. That is not their exposure — it is yours.
See the exposure you actually carry today
The free plan reads one system and scores what it finds — every deduction named, with the register it came from. Most companies find two things nobody knew were wrong.