Skip to content
ASIRI

Nigeria Data Protection Commission

Compliance Audit Return

2026

Not ready to file
Filed by
LagosPay Limited
Registered
RC 1544019
Tier
Ultra high level
Route
Through a licensed DPCO
Due
31 March 2027

Ten of the eleven sections assembled themselves out of registers you already keep. The eleventh will not assemble, and no button on this page can make it.

See what you oweImpact assessments

The pack, laid out

The pack, laid out

10 assembled · 1 blocked

  1. Section 01Who you are and your registration
  2. Section 02What you do with personal data
  3. Section 03Who else touches it
  4. Section 04Data leaving Nigeria
  5. Section 05How long you keep it
  6. Section 06How it is protected
  7. Section 07Incidents in the period
  8. Section 08Requests from people
  9. Section 09Your data protection officer
  10. Section 10The board’s statement
  11. Section 11Credit scoring assessment

Nine are read straight from registers, with nobody retyping anything. One is the board’s statement, which a person writes because nothing generates a signature. And one is red.

Section eleven · DPIA-FILE-0004

The return assembles itself. Then it refuses to submit.

High residual risk means the credit-scoring assessment goes to the Commission before the model goes live. Three of its five fixes have not been started, so the submission is held — not warned about, held. Compliance software that lets you file anyway is a filing cabinet with a progress bar.

What unlocks it

  • A person reviews every decline

    So a model refusing a loan is not the last word. Built and live since May.

    Done

  • Applicants are told a model decided

    The notice paragraph exists in draft and is blocked behind this same assessment.

    Done

  • Test the model for bias by region

    Nobody has been assigned. This is the one that will take longest and it has not begun.

    Not started

  • Record what the model weighed

    So a person asking why they were refused gets an answer rather than a shrug.

    Not started

  • A route to a human, published

    Section 37 requires it. No owner, no date.

    Not started

The filing year

Nothing here happens in March

The return is a by-product of a year that was recorded properly. Companies that treat it as a March event spend February assembling evidence for things they should have been reading all along.

  1. April to DecemberThe year happens

    Registers are read continuously. Nothing is being assembled yet because nothing needs to be.

  2. JanuaryThe pack assembles

    Nine sections resolve from registers. What is missing surfaces now, with two months to fix it.

  3. Today · 29 JulyOne section blocked

    Three fixes unstarted on DPIA-2026-0004, and the model cannot launch until it clears.

  4. February to MarchThe DPCO reviews

    A licensed firm works inside your registers rather than in a pack you email them.

  5. By 31 MarchFiled, and acknowledged

    The receipt is the only proof it was accepted. It is kept with the return.

GAID 2025, Articles 8 and 10 · issued 20 Mar 2025

Three ways in, and you only need one

Two hundred data subjects in six months, membership of any of thirteen listed sectors, or selling commercial ICT services. Any single one makes you a controller of major importance. At the two levels above ordinary high, that is what forces the return through a licensed DPCO rather than letting you sign your own homework.

LagosPay meets two of them. The level above that is a factor test rather than a headcount — 6 questions you can answer about yourself and argue with a regulator about, which a sector label is not.

  1. Ordinary high level

    More than 200 data subjects in six months and up to 1,000, and no sector rule applies. Register, renew it every year, keep the records, answer people — Art. 9(3) asks for no annual return here.

    Volume decides

  2. Extra high level

    Any 4 of 7 factors — or more than 1,000 data subjects in six months and up to 5,000, where no sector rule decides it first.

    Middle band

  3. Ultra high level

    Any 4 of 6 factors is the threshold. LagosPay meets all 6 of ¶2(2): sensitive data at scale, financial assets entrusted to it, third-party cloud, cross-border flows, 264,000 subjects in six months, and a need for international certification.

    You are here

Asiri does not publish your raw customer count anywhere. The tier is the disclosure worth making; the number changes no answer a reviewer needs and tells everybody else the size of the prize.

Last year, for comparison

Filing is the easy half. Proving you filed is the half people lose.

The 2025 return went in eleven days early through Deloitte Nigeria, and the Commission acknowledged it on 2 April. That acknowledgement is the only proof it was accepted — and it lives with the return rather than in somebody’s mailbox.

Letters from the NDPC

NDPC Registry · acknowledgement

Compliance Audit Return
for 2025 · accepted

Period
2025
Filed
19 March 2026
Deadline was
31 March 2026
Through
Deloitte Nigeria
Acknowledged
2 April 2026