The NDPC Compliance Audit Return, explained.

What the CAR is

The Compliance Audit Return is the annual filing through which designated organisations account to the Nigeria Data Protection Commission for their data protection compliance. It is created by the General Application and Implementation Directive 2025 (GAID 2025), made under the Nigeria Data Protection Act 2023 and dated 20 March 2025. Article 10 of the directive establishes the obligation; Schedule 2 defines what the return asks.

Who must file

Controllers and processors of major importance designated at Ultra-High or Extra-High Level file the full return. Organisations at Ordinary-High Level renew their registration with the Commission annually instead. If you are unsure which level applies to your organisation, start with our guide to being a controller of major importance and confirm with a licensed DPCO.

The deadline and the route

Article 10(7) sets 31 March each year for organisations established before 12 June 2023. Under article 10(8), organisations established after that date file their first return within 15 months of establishment, then file annually. Confirm your applicable cycle and any current Commission notice with your DPCO.

• The usual route is a licensed DPCO. Article 10(14) requires UHL and EHL organisations to file through a Data Protection Compliance Organisation licensed by the Commission, except as otherwise approved by the Commission. Agree the audit timetable early so your DPCO can review the evidence before filing.
• Late filing carries a penalty. Article 10(9) provides an administrative penalty of 50% of the stipulated CAR filing fee in addition to that fee when a return is not filed as and when due.

What Schedule 2 actually asks

Schedule 2 organises the return into four broad parts:

• Governance and accountability. Who owns data protection: the DPO’s appointment and standing, board oversight, the internal policy set, and the training record behind them.
• Security of processing. Technical and organisational measures in force, tested against the processing they protect rather than described in the abstract.
• Rights, risk and incidents. Subject request volumes and outcomes, impact assessments for high-risk processing, and the breach register with notification timing.
• Third parties and transfers. Processors engaged, the agreements that govern them, and the legal instrument relied on for each cross-border transfer.

Every one of those questions is answered from a record: a register, a policy, a log, an agreement. That is the whole difficulty of the CAR in one sentence. The return is not hard because any single question is hard; it is hard because it interrogates whether records exist at all.

Keep the evidence ready between reviews

Preparation takes more work when processing records, policies, assessments and supporting documents sit with different teams. Give each record an owner, retain the supporting evidence and record when it was last reviewed. That makes gaps easier to find before the audit.

Maintaining the processing, assessment, request, breach and evidence registers throughout the year gives your DPCO a clearer starting point for review. That is the approach our CARPath product page describes, including how each part of Schedule 2 maps to a named register.

A working calendar

• April to September: maintain the registers as the business changes; new systems enter the record when adopted.
• October to December: run a readiness pass against Schedule 2; every unanswered question becomes an owned task.
• January to February: assemble the draft return, attach evidence answer by answer, brief your DPO.
• March: the DPCO audits against a complete pack and files ahead of the deadline.

This guide summarises obligations created by GAID 2025 (20 March 2025) under the NDPA 2023. The authoritative structure and wording of the return are those published by the Commission, and your DPCO’s audit opinion governs what is finally filed. Read the Commission’s GAID 2025. Reviewed September 2026.