GAID Registration in Nigeria: Classification, Preparation, and What Comes After
NDPC enforcement has been live since September 2025. For businesses that have not yet registered, that is not a missed deadline. It is a current compliance gap with real exposure.
The organisations most at risk are not those that decided against compliance. They are those who assumed registration was simpler than it is: that their classification was obvious, or that the portal was the only thing standing between them and compliance. It is not.
Registration with the NDPC is a milestone within a compliance programme, not the start of one. What you need before you register, how you classify your organisation, and what registration commits you to going forward all carry more weight than the mechanics of completing a form.
This article is part of PlanetWeb’s GAID compliance series. For the foundational framework, see our GAID Nigeria Data Protection Directive guide. For building the underlying compliance programme, see our data protection compliance strategies guide.
How GAID Classifies Your Organisation
The first decision any organisation makes in the registration process is also the most consequential: determining which tier it falls into. GAID establishes three classification levels for data controllers and processors, and the compliance obligations attached to each differ in scope and cost.
Small Data Controllers and Processors
These are organisations with fewer than 40 employees and annual turnover below ₦50 million, processing personal data at relatively low volume and complexity. The registration fee is lower, and formal requirements such as mandatory DPO appointment and annual audit are generally not triggered unless the processing activities themselves are high-risk.
A small clinic processing patient health records, for example, may sit below the turnover threshold but is still conducting sensitive data processing that carries DPIA obligations regardless of its size. Classification does not override the nature of what you process.
Regular Controllers and Processors
The Regular tier sits in the middle, covering organisations that handle personal data at a meaningful scale but do not meet the criteria for Major status. They must register, maintain compliance records, and have a named person responsible for data protection, but are not automatically subject to annual audit requirements.
A mid-size logistics company managing thousands of customer addresses and driver records, or a professional services firm with client databases going back several years, would typically sit here. The key distinction from Major is that the data volumes, sensitivity, and processing activities do not reach the thresholds that trigger the heavier obligation set.
What Major Status Means in Practice
The Major classification carries the heaviest obligations and is where most misclassification risk sits. An organisation qualifies as a Data Controller or Processor of Major Importance (DCPMI) if it meets any of the following:
- Processes personal data for more than 200 individuals within any six-month period
- Has an annual turnover of ₦50 million or above
- Handles sensitive data categories at scale: health records, biometric data, financial data
- Processes data on behalf of any organisation that meets the above criteria
Major status mandates the appointment of a Data Protection Officer, requires an annual compliance audit by a licensed Data Protection Compliance Organisation (DPCO), and triggers DPIA obligations for high-risk processing activities. The fine ceiling for DCPMIs under Section 48 of the NDPA is ₦10 million or 2% of annual gross revenue, whichever is greater.
Misclassification in either direction creates problems. Registering as Regular when you meet the Major criteria leaves you exposed to enforcement for obligations you have not met. Registering as Major when you do not qualify imposes audit costs and reporting requirements that serve no compliance purpose.
What You Need Before You Open the Portal
Registration is not primarily a documentation-gathering exercise. It is a declaration to the NDPC that your organisation has a functioning compliance programme. Businesses that treat it as the former tend to find gaps they cannot paper over quickly.
The requirements below should already be part of your compliance posture, not assembled in the lead-up to submission.
A Completed Data Inventory
Before you can accurately complete the registration form, you need to know what personal data your organisation collects, why you collect it, where it is stored, who has access, and what the lawful basis is for each category of processing. This is the foundation of compliance under GAID and the first thing an NDPC auditor will ask for.
Without it, your registration answers will be estimates rather than documented facts, and estimates do not hold up under scrutiny.
A working data inventory does not need to be sophisticated. A spreadsheet covering the categories of data collected, the purpose, storage location, retention period, and lawful basis is sufficient to start. What matters is that it reflects your actual processing activities and is kept current. An inventory completed once and left untouched for two years is not a compliance asset. It becomes a liability if it no longer matches how you actually operate.
A DPO or Designated Compliance Owner
If you are registering as a Major, the DPO must be in place before registration. The individual must be demonstrably independent and capable of managing your compliance programme, handling data subject requests, and serving as your point of contact with the NDPC.
For Regular and Small registrants, a formal DPO may not be mandatory, but you still need a named person who owns this function. That responsibility cannot sit with no one accountable for it.
DPIA Documentation (Where Applicable)
If your organisation conducts any high-risk processing activities, including automated decision-making, biometric data processing, large-scale monitoring, or profiling, a Data Protection Impact Assessment must be completed before those activities begin. Registration does not substitute for that requirement.
We have broken down the trigger criteria and what the process involves across different sectors in our DPIA guide.
A DPCO Audit Report (Major Registrants Only)
The audit must be conducted by a firm with a current NDPC licence. Using an unlicensed firm is a common and costly mistake. The report will not satisfy the registration requirement, and the process will need to be repeated.
The NDPC maintains a register of licensed DPCOs at ndpc.gov.ng. Checking that register before engaging any firm takes minutes and avoids an expensive detour.
The Registration Process
The NDPC registration portal at ndpc.gov.ng is the only official channel. Account creation, form completion, document upload, fee payment, and status tracking all happen there.
You begin by creating an organisational account and selecting your role: Data Controller, Data Processor, or both, alongside your classification tier. The form asks for your organisation’s registration details, the categories of personal data you process, an estimate of data subjects, your DPO’s details and qualifications, and the lawful basis for your main processing activities.
Having a completed data inventory before this stage means those answers come from documented records rather than reasoned guesses. This is where organisations that skipped the pre-registration groundwork tend to stall: the form asks specific questions that vague answers cannot satisfy.
What to Upload
Documents typically required include your CAC certificate, the DPO appointment letter with evidence of qualification, and, for Major registrants, the DPCO audit report. Supporting documentation, such as your privacy policy, breach response plan, and staff training records, may not be mandatory for submission, but will be expected in any audit.
Registration Fees
Fees are subject to revision by the NDPC and should be verified at the portal before payment.
| Classification | Registration Fee |
|---|---|
| Major Controller / Processor | ₦250,000 |
| Regular Controller / Processor | ₦100,000 |
| Small Organisation (< 40 staff, < ₦50m turnover) | ₦25,000 |
| Government / Public Entity | No fee |
After Submission
The NDPC typically processes applications within 30 working days. Status can be tracked from your dashboard. Use that window to ensure your internal documentation is consistent with what you submitted and that any outstanding compliance gaps are being closed.
What Registration Commits You To
Registration is the beginning of an ongoing compliance posture, not the end of one. Understanding what it commits your organisation to over time is as important as getting the initial application right.
Annual Renewal
Registration is valid for 12 months and must be renewed each year at the same fee level. A lapsed registration carries the same exposure as not being registered at all.
Change Notifications Within 30 Days
If your DPO changes, your business expands into new data processing categories, your turnover crosses a classification threshold, or your processing activities shift materially, you must notify the NDPC through the portal within 30 days.
Many organisations get registration right and then neglect this during periods of growth, particularly when a compliance owner leaves and the function drifts.
Ongoing Audit Obligations
Major registrants must complete an annual audit by a licensed DPCO regardless of whether complaints have been raised against them. Regular and Small registrants are not subject to the same mandatory cycle, but the NDPC can initiate an audit at any time based on a complaint, a sector-level review, or a risk-based selection.
The question is not whether your organisation will face scrutiny. It is whether your documentation will hold up when it does.
What Audit Readiness Requires
The NDPC will expect to see your data inventory and lawful basis records, your data subject request log, your breach response plan and incident records, vendor contracts with data processing provisions, and evidence of staff training.
On vendor contracts specifically: many Nigerian businesses use cloud platforms, payroll providers, CRM systems, and payment gateways that process personal data on their behalf. Under the NDPA, the data controller remains responsible for what those vendors do with that data. A contract without a breach notification clause, audit rights, or data processing terms is a gap that NDPC scrutiny will expose.
The SNAG process, which is the formal internal grievance mechanism through which data subjects can demand remedial action, should also be in place and understood by whoever manages your NDPC communications. For a full breakdown of what a SNAG notice triggers, see the NDPA compliance guide.
For context on how data breach obligations intersect with the broader compliance framework, including what the 72-hour NDPC notification window requires in practice, see our data breach response guide.
Where Organisations Go Wrong
Underclassifying
The most frequent error is registering as Regular when Major criteria are clearly met. The 200-data-subjects figure is lower than most business owners assume. A marketing agency with a client email database, an HR platform managing staff records for multiple employers, or an e-commerce store tracking customer purchases can cross it quickly.
The consequences surface at audit, when the absence of a DPO and an annual DPCO review become compliance failures that carry penalties.
Appointing an Unqualified or Conflicted DPO
Assigning the Head of IT or the Finance Director to the role without assessing whether their other responsibilities create a conflict is not sufficient. The NDPC assesses independence, and a nominally appointed DPO with no practical authority over compliance decisions will not satisfy the requirement.
For smaller organisations without an internal person who meets the criteria, outsourced DPO services are available from NDPC-licensed practitioners. Engaging one is often more cost-effective than upskilling an existing staff member to meet the standard.
Registering Without a Completed Data Inventory
Registration answers built on estimates are internally inconsistent and will not match the documented position the NDPC expects to find on closer review. The data inventory should precede registration, not follow it.
Letting the Renewal Lapse
Many organisations miss their renewal deadline because no one owns the calendar obligation. Assigning ongoing responsibility for renewal and change notifications to a named person, with a reminder set well before the annual anniversary, is straightforward and frequently overlooked.
Frequently Asked Questions
Registration errors are rarely discovered at the point of submission. They emerge months later during an audit, a data subject complaint investigation, or when an NDPC enforcement notice arrives. By then, the gap between what was submitted and what actually exists in the organisation’s compliance programme is harder and more expensive to close.
The businesses that get this right are not necessarily the most sophisticated. They are the ones who treated classification and pre-registration preparation as the real work and used the portal for what it actually is: the final step.
For organisations navigating classification uncertainty, preparing for a first NDPC audit, or working through pre-registration requirements, professional guidance removes the risk of errors that surface later at high cost. PlanetWeb works with Nigerian organisations on data protection readiness from initial assessment through to ongoing compliance support. If you would like to understand where your organisation stands, get in touch.
Updated March 2026
