For NDPA 2023 and GAID 2025
Estreat keeps your processing records, impact assessments, rights requests, breach response and evidence together, and prepares your annual Compliance Audit Return from them.
The product, shown with demonstration data.
The record
What you hold, why, and who it goes to.
The clock
Requests and breaches, tracked to their deadlines.
The return
Your annual audit return, prepared from the record.
The annual audit return should not be a project. Keep the record all year and the return comes out of it.
What it does
The record
Processing records · Impact assessments · Vendors
Each activity carries its purpose, lawful basis, retention and safeguards. High-risk ones are flagged for an impact assessment as you save them.
Processing recordsThe clock
Rights requests · Breach response
Every request shows the days left. Every breach starts its 72-hour clock, with the duties to assess listed beside it.
Rights and breach responseThe return
CARPath · Evidence · DPO reports
CARPath prepares the Schedule 2 return from your records, shows what is still missing, and exports it for your licensed DPCO.
CARPathWhy it matters
31 March
The annual audit return date
GAID 2025, article 10(7). For organisations established before 12 June 2023.
72hours
To notify the Commission of a qualifying breach
NDPA 2023, section 40
₦10mor 2%
Of annual gross revenue, whichever is greater: the higher maximum fine
NDPA 2023, section 48
38,677
Organisations of major importance on the Commission register
NDPC figures, reported February 2026
In the product
Each request shows its due date and the days left. A breach starts its 72-hour clock when you record awareness.
Rights and breach response
The Nigeria Data Protection Act 2023 and GAID 2025 are the baseline, not an add-on.
About EstreatIkoyi and Lagos Island. Photograph by Reginald Bassey, CC BY-SA 4.0. Shown cropped and toned.
Free readiness check
No email needed. It takes about two minutes.
Nigerian organisations managing data protection obligations, the DPOs responsible for their programmes, and licensed DPCOs supporting audit preparation.
Yes. Choose “Not yet determined” in your enquiry. You can start with the readiness check and discuss the records you have. Confirm your designation and specific obligations with the Commission or a qualified adviser.
No. Estreat is software. The usual CAR filing route is through a licensed DPCO, except as otherwise approved by the Commission under GAID article 10(14). Estreat organises the records and evidence for that review.
We look at one business process and the records you keep today, show the matching workflow, and discuss fit and pricing.
A 20-minute walkthrough of one of your processes.
Abuja from Katampe hill, with Aso Rock on the horizon. Photograph by Kritzolina, CC BY-SA 4.0. Shown cropped and toned.
