CARPath
The return is the output of the year, not a project in March.
Organisations designated as controllers or processors of major importance at Ultra-High and Extra-High Level must file an annual Compliance Audit Return with the Nigeria Data Protection Commission, through a licensed Data Protection Compliance Organisation. CARPath treats that return as the natural export of a record you keep all year.
| Instrument | GAID 2025, made under the NDPA 2023 |
| Who files | Ultra-High and Extra-High Level controllers and processors of major importance |
| Standing deadline | 31 March each year |
| Route | Through a DPCO licensed by the Commission |
| Late filing | Attracts a surcharge on the applicable fee |
Ordinary-High Level entities renew their registration annually rather than filing a full return. Confirm your own designation before relying on any summary, including this one. See GAID 2025 and the Commission.
Schedule 2 mapping
Every question traced to a record, not to a memory.
CARPath holds the structure of Schedule 2 and binds each part of it to the register that answers it. When a question cannot be answered, the platform names the missing record rather than reporting a percentage.
Governance and accountability
Appointment and standing of the data protection officer, board oversight, internal policy set, and the training record behind it.
Answered from: RoPA owners, evidence vault, company profile
Security of processing
Technical and organisational measures in force, tested against the processing they protect rather than described in the abstract.
Answered from: Control register and evidence vault
Rights, risk and incidents
Subject request volumes and outcomes, impact assessments for high-risk processing, and the breach register with notification timing.
Answered from: Rights queue, DPIA register, breach register
Third parties and transfers
Processors engaged, the agreements that govern them, and the legal instrument relied on for each cross-border transfer.
Answered from: Processor register and RoPA transfer fields
The headings above summarise how Estreat organises the return. The authoritative structure and wording of the audit return remain those published by the Commission, and your DPCO’s audit opinion governs what is finally filed.
The filing year
Twelve months of small work instead of one month of panic.
The compliance calendar is predictable. The failure mode is not the deadline itself but the decision to begin preparing near it, when the people who hold the facts are also closing their own year.
The 2026 cycle was extended beyond the standing March date by the Commission, which is a reprieve rather than a plan. CARPath is built around the statutory date.
April to September
The record is maintained as the business changes. New systems, processors and processing activities enter the register at the point they are adopted, which is the only point at which the detail is actually known.
October to December
A readiness pass runs against Schedule 2. Every unanswered question becomes a task with a named owner and a date, while there is still ordinary working time to close it.
January to February
The draft return is assembled from the record and reviewed by your data protection officer. Evidence is attached answer by answer, so the reviewer confirms rather than reconstructs.
March
Your licensed DPCO conducts its audit against a complete pack and files the return with the Commission ahead of the deadline. Late filing attracts a surcharge, so the pack is finished before March begins.
What you hand over
A pack an auditor can review in one sitting.
The export is deliberately conventional: a structured data file for systems, a paginated document for people, and an evidence index that ties each attachment to the answer it supports.
- The return itself, rendered as a paginated document with your entity details, designation and attestation.
- A structured export of the same content, so your DPCO or your own systems can ingest it without re-keying.
- An evidence index listing every artefact, its category, its date and the obligation it evidences.
- A change history showing when each answer was last updated and by whom, which is what turns an assertion into a record.
Where Estreat stops, and a DPCO begins.
Estreat is a software company. We prepare, evidence and package the return, and we work alongside DPCOs licensed by the Commission who conduct the audit and file it. We do not hold a DPCO licence, we do not issue audit opinions, and we are not a law firm. If you do not yet have a DPCO relationship, we will introduce you to one.