Compliance Audit Returns
Periodic audit filings required of DCPMIs under the GAID.
How the laws define this
Both instruments establish that these filings are mandatory compliance reports that designated controllers and processors, particularly DCPMIs, must submit to the NDPC to document audit outcomes, identified risks or gaps, and remediation or corrective action plans for regulatory monitoring. However, the instruments diverge in their emphasis and procedural detail. Under the framework described in the Nigeria Data Protection Act (NDPA), the focus is broadly on reporting the results of internal or external audits, risk assessments, and remediation as part of oversight. In contrast, the General Application and Implementation Directive (GAID) of the Nigeria Data Protection Act details specific operational mechanics, requiring integration with a record of processing activities (RoPA) and establishing defined filing cycles, standardized CAR templates, and a submission pathway through licensed DPCOs to achieve regulatory comparability.
Synthesised from the 2 statutory definitions below. Each one is quoted in full, with its source.
Definitions (2)
Mandatory annual or periodic reports that DCPMIs must file with the NDPC under the GAID, documenting the results of internal or external compliance audits, risk assessments, and remediation actions as part of the Commission's monitoring and supervisory regime.
Structured audit reports required under GAID that designated controllers/processors (particularly DCPMIs) must file with the NDPC, documenting compliance status, RoPA integration, identified gaps, and corrective action plans. GAID prescribes CAR templates, filing cycles, and the submission pathway through licensed DPCOs to enable regulatory monitoring and comparability.
Related Terms
Compliance Audit Returns (CAR)
Periodic audit filings submitted to the NDPC via licensed bodies....
General Application and Implementation Directive (GAID) 2025
NDPC's implementing directive operationalising the NDPA....
Data Protection Compliance Organisation (DPCO)
Licensed organisations authorised to perform compliance audits and filings....
Data Controllers and Processors of Major Importance (DCPMI)
Entities meeting thresholds requiring enhanced registration and oversight....
Data Controller/Processor of Major Importance (DCPMI)
A regulated classification triggering registration and enhanced obligations....