Skip to content
ASIRI

Federal Republic of Nigeria · Data Protection Commission

Certificate of registration

LagosPay Limited is entered on the register of data controllers and processors of major importance.

Reference
NDPC/CTR/2025/04417
Registered
28 March 2025
Renews
31 March 2027
Fee
₦250,000 · paid Mar 2026

NDPA modules · NDPC registration

A certificate is a receipt, not a defence.

It proves you told the Commission you exist. What it does not prove is that the tier you registered under is the right one, or that the three obligations it switched on are being met — and one of them is not.

Check your tierWhat you file

Basis · a fintech, ultra high level by sector

The tier is a judgement, not a fact — and if it is wrong, what you owe changes

Including whether you file an annual return at all. Asiri records the basis for the judgement in the same words you would have to defend it in, rather than storing a tier and hoping nobody asks how you arrived at it.

Evidence held against the registration

  • Certificate of registration

    The document above, held as filed.

    NDPC/CTR/2025/04417.pdf

  • Payment receipt

    Proof the fee was paid, which the certificate itself does not show.

    receipt-mar-2026.pdf

  • Last audit return filed

    Filed 27 March 2026 through a licensed DPCO, acknowledged 2 April.

    CAR-2025

  • Board minute appointing the DPO

    The decision that created the role. The appointment exists; the authority for it was never written down.

    Nothing on file

The missing one is a board minute appointing the officer. Nobody notices it until an auditor asks who authorised the appointment — and then the answer is that the appointment exists but the decision behind it was never recorded.

What registering switched on

Three obligations arrived with the certificate

None of them were on the form. Registering as a controller of major importance is not an administrative step that concludes — it is the moment three permanent duties start, and Asiri shows the state of each one beside the certificate rather than in a different part of the product.

  • Filed for 2025File an audit return every year

    Compulsory at this tier rather than good practice, and it must go through a licensed DPCO. The 2026 return is ten of eleven sections assembled.

  • Appointed, with a conflictAppoint a data protection officer

    Tunde Adeyemi holds the role at 0.4 of a full-time job — and also runs the fraud operations he would be reviewing.

  • 12 activities · 4 incompleteKeep a record of what you do with data

    The register the Commission asks for first. Two activities have no lawful basis recorded at all.

Kore Advisory Ltd · DPCO/2024/0119

They file on your behalf. They do not carry your obligation.

If a licensed provider misses a date, it is still your breach and your name on the enforcement file. The contract you have with them is a commercial matter between two companies; the duty under the Act never moved.

Which is why Asiri keeps the renewal clock on your side of the relationship, whoever presses the button.

Find a licensed firm

Renewal

Your clock, not theirs

249 days

Engaged
January 2026
Contract until
February 2027
Contact
Ifeoma Kalu
Scope
Return, registration, training