The NDPC Compliance Audit Return, explained.

What the CAR is

The Compliance Audit Return is the annual filing through which designated organisations account to the Nigeria Data Protection Commission for their data protection compliance. It is created by the General Application and Implementation Directive 2025 (GAID 2025), made under the Nigeria Data Protection Act 2023 and dated 20 March 2025. Article 10 of the directive establishes the obligation; Schedule 2 defines what the return asks.

Who must file

Controllers and processors of major importance designated at Ultra-High or Extra-High Level file the full return. Organisations at Ordinary-High Level renew their registration with the Commission annually instead. If you are unsure which level applies to your organisation, start with our guide to being a controller of major importance and confirm with a licensed DPCO.

The deadline and the route

The standing deadline is 31 March each year. Two structural facts about the deadline matter more than its date:

• You cannot file alone. The return goes to the Commission through a Data Protection Compliance Organisation licensed by the Commission. There were 317 licensed DPCOs as of February 2026, and their capacity in the final weeks of March is finite. Your DPCO conducts an audit before filing, which means they need your evidence weeks before the deadline, not on it.
• Late costs money. Missing the date attracts a surcharge on the applicable fee. The Commission did extend the 2026 cycle, which organisations should read as a one-cycle reprieve, not a precedent.

What Schedule 2 actually asks

Schedule 2 organises the return into four broad parts:

• Governance and accountability. Who owns data protection: the DPO’s appointment and standing, board oversight, the internal policy set, and the training record behind them.
• Security of processing. Technical and organisational measures in force, tested against the processing they protect rather than described in the abstract.
• Rights, risk and incidents. Subject request volumes and outcomes, impact assessments for high-risk processing, and the breach register with notification timing.
• Third parties and transfers. Processors engaged, the agreements that govern them, and the legal instrument relied on for each cross-border transfer.

Every one of those questions is answered from a record: a register, a policy, a log, an agreement. That is the whole difficulty of the CAR in one sentence. The return is not hard because any single question is hard; it is hard because it interrogates whether records exist at all.

Why most organisations struggle

Commission figures reported in February 2026 put 38,677 controllers and processors of major importance on the register, against 8,155 returns ever filed. Barely a fifth of the registered population has filed even once. The gap is not indifference; it is architecture. Most organisations treat the return as a document produced once a year by a consultant, reconstructed from records that were never kept. Under audit, a reconstructed answer survives exactly as long as it takes to ask a follow-up question.

The organisations that file calmly treat the return as an export. They keep the registers during the year — processing, assessments, requests, breaches, evidence — and the return assembles from them. That is the approach our CARPath product page describes, including how each part of Schedule 2 maps to a named register.

A working calendar

• April to September: maintain the registers as the business changes; new systems enter the record when adopted.
• October to December: run a readiness pass against Schedule 2; every unanswered question becomes an owned task.
• January to February: assemble the draft return, attach evidence answer by answer, brief your DPO.
• March: the DPCO audits against a complete pack and files ahead of the deadline.

This guide summarises obligations created by GAID 2025 (20 March 2025) under the NDPA 2023. The authoritative structure and wording of the return are those published by the Commission, and your DPCO’s audit opinion governs what is finally filed. Reviewed August 2026.