CARPath
The return is the output of the year, not a project in March.
Ultra-High and Extra-High Level controllers and processors of major importance file an annual Compliance Audit Return with the Nigeria Data Protection Commission. The usual route is through a licensed DPCO, except as otherwise approved by the Commission under GAID article 10(14). CARPath connects that preparation to the record you keep all year.
The Schedule 2 questionnaire and supported preparation are available. You can record an explicit reviewer declaration and an external-submission statement for a saved return. Estreat does not submit it to the Commission or verify acceptance. Review the return and its evidence with your DPCO. See our target of at most 10% manual input.
| Instrument | GAID 2025, made under the NDPA 2023 |
| Who files | Ultra-High and Extra-High Level controllers and processors of major importance |
| Standing deadline | 31 March each year for organisations established before 12 June 2023 (article 10(7)) |
| First return for newer organisations | Within 15 months of establishment for organisations established after 12 June 2023, followed by annual filing (article 10(8)) |
| Route | Usually through a licensed DPCO, except as otherwise approved by the Commission (article 10(14)) |
| Late filing | An administrative penalty of 50% of the stipulated filing fee, in addition to that fee (article 10(9)) |
Ordinary-High Level entities renew their registration annually rather than filing a full return. Confirm your designation, applicable cycle and any current Commission notice before relying on this summary. See GAID 2025 and the Commission. Reviewed September 2026.
Build each answer from the record behind it.
Processing, governance, security and response records provide facts for your return. CARPath brings supported facts into preparation; the remaining questions need evidence and review. A completed field does not by itself establish compliance.
Governance and accountability
Appointment and standing of the data protection officer, board oversight, internal policy set, and the training record behind it.
Relevant sources: RoPA owners, evidence vault, company profile
Security of processing
Technical and organisational measures in force, tested against the processing they protect rather than described in the abstract.
Relevant sources: Control register and evidence vault
Rights, risk and incidents
Subject request volumes and outcomes, impact assessments for high-risk processing, and the breach register with notification timing.
Relevant sources: Rights queue, DPIA register, breach register
Third parties and transfers
Processors engaged, the agreements that govern them, and the legal instrument relied on for each cross-border transfer.
Relevant sources: Processor register and RoPA transfer fields
The headings above summarise how Estreat organises the return. The authoritative structure and wording of the audit return remain those published by the Commission, and your DPCO’s audit opinion governs what is finally filed.
Twelve months of small work instead of one month of panic.
This example follows the 31 March cycle in article 10(7) for organisations established before 12 June 2023. Spread record updates and reviews through the year so preparation does not begin just before the deadline.
Organisations established after that date have up to 15 months from establishment for their first return, followed by annual filing under article 10(8). Confirm your applicable cycle and any current Commission notice with your DPCO.
April to September
The record is maintained as the business changes. New systems, processors and processing activities enter the register at the point they are adopted, which is the only point at which the detail is actually known.
October to December
Review Schedule 2 coverage and assign outstanding questions and evidence to the right people while there is still time to resolve them.
January to February
Prepare the draft with your data protection officer, reuse supported answers and attach the evidence for each conclusion. Resolve incomplete mappings and unanswered questions before audit.
March
For the usual DPCO route, your licensed DPCO audits the pack and handles filing with the Commission. Allow time to resolve findings and confirm receipt before the applicable deadline.
Prepare a pack your auditor can trace.
The export is deliberately conventional: a structured data file for systems, a paginated document for people, and an evidence index that ties each attachment to the answer it supports.
- A readable draft with your entity details, designation and recorded answers. Complete the required review before recording a reviewer declaration.
- The exact return retained with your declaration, available as JSON, Markdown or PDF for your DPCO and your own records.
- An external-submission statement with the submission date and an optional reference, recorded after submission outside Estreat. It is your statement, not a regulator receipt or an audit opinion.
- An evidence index listing every artefact, its category, its date and the obligation it evidences.
- The source references and review notes needed to explain your conclusions and resolve remaining questions.
Where Estreat stops, and a DPCO begins.
Estreat is a software company. We prepare, evidence and package the return, and we work alongside DPCOs licensed by the Commission who conduct the audit and file it. We do not hold a DPCO licence, we do not issue audit opinions, and we are not a law firm. If you do not yet have a DPCO relationship, we will introduce you to one.