FrameworksNDPA
Your annual return, read from your own registers
NDPA 2023 is not a form you fill in each March. Asiri keeps the records the return reads, works out who files it and by when, and leaves the opinion to the licensed DPCO who signs it.
- Overview
- Registers
- Return
- Opinion
NDPA programme overview
Koru Commerce · extra-high level · files through a licensed DPCO
Return sections
- Processing activities
- Lawful basis
- Security measures
- Incidents
- Transfers
- Return sections answerable7 of 10
- Lawful basis still open3 of 42
- Security measures complete18 of 18
- Registers
- Annual return
- Deadline
- DPCO review
- Signed opinion
Run the NDPA beside the other frameworks you answer to
Keep the registers the return reads
Processing activities, lawful basis, security measures, requests, incidents, assessments, processors, transfers, retention and age checks are kept as live records with owners. Eri drafts entries from department answers, and nothing enters a register until a person accepts it.
- 10
- Return sections, each read from the record it reports on
- 72h
- To tell the Commission about a breach once you know (NDPA s. 40)
- Processing activitiesAll 42 complete
- Lawful basis3 of 42 still open
- Security measuresAll 18 complete
- IncidentsNothing recorded
- TransfersNothing examines it
Illustrative workspace. Each state is read from the register beneath it.
Know who files, and by when
Your recorded tier decides whether a return is owed and who submits it. Your establishment date decides the deadline. Pick yours and see what the Act asks of you.
Start freeNot sure of your tier? Work it out with GAID
Your DPCO tests the file, then signs
The licensed firm works inside an engagement you granted. When an answer says yes and a test behind it raised an exception, the answer is marked as contradicted by your file. The opinion stays empty until the DPCO signs it.
Start free- Lawful basisAnswered “Yes” in the returnYour file says otherwise
- Security measuresTestedNo exception
- RetentionSample of five recordsIn review
- Part G · Auditor’s opinionOpinion pending
The opinion is read only from what the DPCO signs.
- Processing activitiesAll 42 complete
- Lawful basis3 of 42 still open
- Security measuresAll 18 complete
- IncidentsNothing recorded
- TransfersNothing examines it
Illustrative workspace. Each state is read from the register beneath it.
Framework mapping
Reuse the work your NDPA programme already does. Each requirement reads the controls mapped beneath it, so one control can support several frameworks without duplicating the work.
GAID 2025
Directive · decides your tier
The tier you reach decides whether a return is owed, what it costs and who may sign it.
Learn more about GAID 2025GDPR
Regulation · self-assessment
Compare lawful basis, rights and transfers article by article. A mapping is a starting point, not a finding of compliance.
Learn more about GDPRISO 27001
Certificate · security
Security measures, suppliers and incidents carry over. Lawful basis and people’s rights stay the Act’s alone.
Learn more about ISO 27001
Additional features
Start freeDepartment interviews
Finance, HR and IT explain what they do in their own words. Their answers become the source for the records that follow.
Drafts from Eri
Eri drafts processing records with the source beside every line. A person accepts each one before it counts.
Deadlines worked out
The return date follows from your tier and when you were established, so nobody has to remember it.
Breach and request clocks
Incidents and subject requests start their own clocks from the record, not from when someone notices.
A licensed DPCO, found
Browse licensed firms in the marketplace and grant one an engagement with the access you choose.
Trust Centre
Share what customers ask about from approved records, and keep the rest private.
“A blank register is not an exemption. When nothing examines part of the return, Asiri says so rather than showing it as clean.”
Learn more about NDPA
NDPA readiness checklist
Work through what the Act asks of a controller, one question at a time.
Read moreWhat non-compliance costs
See how the Act sets a remedial fee, and run the numbers for your own turnover.
Read moreThe NDPA glossary
Plain definitions for the terms the Act and the Commission use.
Read more
FAQ
Can we file the annual return ourselves?
It depends on your tier. At the ultra-high and extra-high levels the return reaches the Commission through a data protection compliance organisation licensed by it. At the ordinary-high level no annual return is owed; the registration renewal takes its place, as long as the renewal is actually made.
What if we have not recorded our registration?
Then nothing can say whether a return is owed, and Asiri does not guess. A blank is not an exemption. Record the registration and its tier first, or work it out with the GAID page.
When is our return due?
A controller established before 12 June 2023 files by 31 March each year. One established after that date files its first return within fifteen months of establishment, then annually (GAID 2025, Art. 10(7) and 10(8)). Asiri works the date out from what you record.
Does a full readiness bar mean we are compliant?
No. It means every section of the return can be answered from your registers. Whether the answers show compliance is the licensed DPCO’s opinion, which Asiri reads only from the signed record.
Are statutory fees and professional services included?
No. Software plans, the DPCO’s professional fees and the Commission’s statutory fees are separate. Agree the professional scope and fees with your DPCO.