NDPA 2023 · GAID 2025 · NDPC
Compliance you can produce on demand.
Estreat keeps a Nigerian organisation’s data protection obligations as a live record — processing activities, impact assessments, subject requests, breaches and evidence — and turns that record into the Compliance Audit Return the Commission expects each year.
Built for controllers and processors of major importance, their data protection officers, and the DPCOs who audit them.
38,677
controllers and processors of major importance registered with the NDPC
8,155
compliance audit returns filed with the Commission to date
317
licensed Data Protection Compliance Organisations in Nigeria
31 March
standing annual deadline for CAR filing under GAID 2025, article 10
Registration, filing and licensing figures reported by the Nigeria Data Protection Commission in February 2026, via Vanguard. Deadline per GAID 2025.
Where organisations get caught
Nearly forty thousand organisations are registered. Barely a fifth of that number has ever filed a return.
The gap is not indifference. It is that compliance is treated as a document produced once a year by a consultant, from records that were never kept in the first place. Estreat closes the gap by keeping the records.
- 01
The record does not exist until March
RoPA and DPIA content is reconstructed from memory under deadline pressure, so it describes an organisation that no longer exists and cannot survive a question from an auditor.
- 02
Statutory clocks run without a timekeeper
A breach must be notified to the Commission within 72 hours of awareness, and subject requests carry their own deadlines. Email threads are not a register, and they do not prove when you knew.
- 03
Evidence is scattered across drives and inboxes
Policies, training logs and processor agreements exist, but nobody can map them to the control they satisfy. The audit becomes an archaeology exercise billed by the hour.
The platform
Six registers, one record, no re-keying.
Every module writes to the same underlying record, so a processing activity captured in onboarding appears in your DPIA scope, your transfer analysis and your annual return without anyone copying it across.
Record of processing
A living RoPA built from plain questions about your business, with lawful basis, retention and cross-border transfers checked as you go.
Impact assessments
DPIA workflows for high-risk processing, scored against GAID criteria, with mitigations and sign-off held on the record.
Data subject requests
One inbox for access, rectification, erasure and objection requests, with statutory clocks and templated responses.
Breach register
A 72-hour notification clock from the moment of awareness, the facts you must report, and the decision trail behind it.
Evidence vault
Policies, training logs, processor agreements and screenshots, each tied to the control it proves and dated.
CARPath returns
Your Compliance Audit Return assembled continuously against GAID Schedule 2, ready for filing through a licensed DPCO.
CARPath
The annual return, assembled all year.
Ultra-High and Extra-High Level organisations must file a Compliance Audit Return each year through a licensed DPCO. CARPath maps every question in GAID Schedule 2 to the record you already keep, shows you exactly what is missing while there is still time to fix it, and packages the return with its supporting evidence.
- Schedule 2 coverage tracked question by question, with a readiness view by month.
- Gaps raised as owned tasks, not as a report you receive in March.
- Evidence attached to each answer so the auditor reviews rather than re-interviews.
- Filing coordinated with a licensed DPCO partner, with your DPO in the loop.
Under GAID 2025 a Compliance Audit Return is filed through a Data Protection Compliance Organisation licensed by the Commission. Estreat prepares and packages the return and works alongside licensed DPCO partners; we do not represent ourselves as a licensed DPCO.
Operating rhythm
A calendar, not a fire drill.
Estreat is built for organisations with one data protection officer and no spare capacity. The work is spread across the year in small, owned increments, and the system chases the owner rather than the other way round.
Week one
Guided onboarding establishes your entity, tier, systems and processors, and produces a first RoPA in a working session rather than a workshop series.
Every week
Open subject requests, breach clocks and stale evidence surface to their owners. Nothing waits for a quarterly review to be noticed.
Every quarter
Readiness review against Schedule 2, transfer and processor checks, and a refresh of policies and training records.
January to March
The return is already assembled. Your DPO reviews, the DPCO audits, and the filing goes in ahead of the deadline.
A Nigerian company
Built here, held to the standard of the markets we sell into.
Estreat Technologies Limited is a Nigerian private company, wholly owned by Nigerian citizens, building for the Nigerian regulatory perimeter first. Our engineering practice comes from cloud security and compliance automation work delivered for regulated and public sector buyers in the United States, and we apply the same controls, review discipline and documentation standard here.
About the company| Entity | Estreat Technologies Limited, Nigeria |
| Base | Lagos, Nigeria |
| Regime | NDPA 2023 and GAID 2025 |
| Residency | Nigerian data residency, with EU region available |
See it against your own processing.
Bring one business process and we will map it live — lawful basis, retention, transfers, and the Schedule 2 questions it answers.