Perform initial compliance audit within fifteen months of business commencement
Under General Application and Implementation Directive (GAID) 2025
Overview
Data controllers and processors are expected to conduct their first NDP Act compliance audit within Fifteen (15) months of commencing business and repeat it annually. Imported research notes (check before approving): • Duty holders (any one of): data controller; data processor • Applies when: commencement of business • Timing in the source: "within Fifteen (15) months of commencement of business"
Important
This requirement was extracted from the source document. Applicability depends on your organization's circumstances. Review the official source and obtain professional advice where appropriate.
Key information
- Policy
- NDP Act-GAID 2025
- Jurisdiction
- Nigeria
- Obligation type
- Audit
- Frequency
- Event-based
- Suggested owner
- Data Protection Officer
- Policy categories
- Data Protection, Cybersecurity, Privacy
- Source
- Article 7(b), Article 7(b), page 13
- Policy last reviewed
- Oct 23, 2026
Details
When this applies
Event-based · within Fifteen (15) months of commencement of business — exact deadline not calculated
From the source
“Conduct a NDP Act compliance audit within Fifteen (15) months of commencement of business and thereafter on an annual basis; c) In the case of data controllers and data processors of major importance (Ultra High Level and Extra-High Level as defined in Article 8 of this NDP Act- GAID), file NDP Act Compliance Audit Returns (CAR) with the”
Article 7(b), Article 7(b), page 13
Other obligations in this policy
Explore other identified requirements from the same source policy.
Remindash provides this information to help organizations identify and track potential obligations. Applicability can depend on your organization's circumstances. Review official sources and obtain professional advice where appropriate.