Compliance

Compliance Audit Returns

Periodic audit filings required of DCPMIs under the GAID.

How the laws define this

Both instruments establish that these filings are mandatory compliance reports that designated controllers and processors, particularly DCPMIs, must submit to the NDPC to document audit outcomes, identified risks or gaps, and remediation or corrective action plans for regulatory monitoring. However, the instruments diverge in their emphasis and procedural detail. Under the framework described in the Nigeria Data Protection Act (NDPA), the focus is broadly on reporting the results of internal or external audits, risk assessments, and remediation as part of oversight. In contrast, the General Application and Implementation Directive (GAID) of the Nigeria Data Protection Act details specific operational mechanics, requiring integration with a record of processing activities (RoPA) and establishing defined filing cycles, standardized CAR templates, and a submission pathway through licensed DPCOs to achieve regulatory comparability.

Synthesised from the 2 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
Nigeria	Nigeria Data Protection Act (NDPA)	In Force	This definition emphasizes documenting results of internal or external compliance audits, risk assessments, and remediation actions as part of the NDPC's monitoring regime under the NDPA.
Nigeria	General Application and Implementation Directive (GAID) of the Nigeria Data Protection Act	In Force	This definition highlights structured reports with RoPA integration, identified gaps, corrective action plans, prescribed CAR templates, filing cycles, and submission through licensed DPCOs under the GAID.

What it triggers

Under the Nigeria Data Protection Act (NDPA), DCPMIs must file mandatory annual or periodic Compliance Audit Returns with the NDPC.
Under the General Application and Implementation Directive (GAID) of the Nigeria Data Protection Act, designated controllers and processors, particularly DCPMIs, must file structured audit reports with the NDPC.

Definitions (2)

Mandatory annual or periodic reports that DCPMIs must file with the NDPC under the GAID, documenting the results of internal or external compliance audits, risk assessments, and remediation actions as part of the Commission's monitoring and supervisory regime.

Nigeria Data Protection Act (NDPA)Definition 1 of 2

Structured audit reports required under GAID that designated controllers/processors (particularly DCPMIs) must file with the NDPC, documenting compliance status, RoPA integration, identified gaps, and corrective action plans. GAID prescribes CAR templates, filing cycles, and the submission pathway through licensed DPCOs to enable regulatory monitoring and comparability.

General Application and Implementation Directive (GAID) of the Nigeria Data Protection ActDefinition 2 of 2

Not to be confused with

Data Protection Compliance Organisation (DPCO)

DPCO refers to licensed organisations that perform compliance audits and handle filings, while Compliance Audit Returns are the reports filed through them.

Data Controllers and Processors of Major Importance (DCPMI)

DCPMI identifies entities subject to enhanced oversight requiring Compliance Audit Returns, but is not the returns themselves.

Questions and answers

Who must file Compliance Audit Returns in Nigeria?

DCPMIs must file them with the NDPC. Designated controllers and processors, particularly DCPMIs, are required under the GAID.

What do Compliance Audit Returns document?

They document results of compliance audits, risk assessments, remediation actions, compliance status, RoPA integration, gaps, and corrective plans.

How are Compliance Audit Returns submitted under GAID?

GAID prescribes CAR templates, filing cycles, and submission pathway through licensed DPCOs to the NDPC for regulatory monitoring.