Data controller of major importance: designation and what follows from it.

Why the designation matters

The Nigeria Data Protection Act 2023 gives the Nigeria Data Protection Commission a supervisory toolkit that scales with risk. Organisations designated as data controllers or processors of major importance sit at the centre of that toolkit: they register with the Commission, maintain the statutory registers, observe the breach clock, and answer for all of it annually. The General Application and Implementation Directive 2025, made under the Act on 20 March 2025, grades those organisations into levels and attaches concrete obligations to each.

The scale is no longer theoretical. Commission figures reported in February 2026 count 38,677 controllers and processors of major importance on the register. Designation is the norm for formal organisations in Nigeria, not the exception.

What points toward major importance

The Act and its guidance weigh the nature and scale of processing rather than any single threshold. Indicators that consistently point toward major importance include:

• Processing carried out on a large scale, in absolute volume or across markets.
• Sensitive categories of data: health, biometrics, financial information, children’s data.
• Operating in a regulated sector where data protection intersects existing supervision, such as financial services, telecommunications, healthcare or education.
• Systematic monitoring or profiling of individuals.
• Cross-border transfer of personal data as a routine part of the business.

None of these factors alone settles the question, and the Commission’s designation guidance governs. But if several apply to you, plan on the assumption that you are designated, and verify formally with a qualified DPO or licensed DPCO.

The GAID 2025 levels

GAID 2025 grades designated organisations into levels. Three matter most in practice:

• Ultra-High Level. The heaviest scrutiny. Files the full annual Compliance Audit Return through a licensed DPCO, with everything that implies for evidence quality.
• Extra-High Level. Also files the full annual return through a licensed DPCO under article 10 of the directive.
• Ordinary-High Level. Renews registration with the Commission annually rather than filing a complete return, and remains fully subject to the Act’s substantive duties: the processing record under section 29, impact assessments under section 28, the breach clock under section 40, and data subject rights under Part V.

Levels can change as your organisation grows or changes what it does with data. A designation review belongs in due diligence for any new product line, market or acquisition, not only in the annual calendar.

What a designated organisation must actually do

Strip away the terminology and the obligations reduce to five standing duties:

1. Register with the Commission at the correct level, and keep the registration current.
2. Maintain a record of processing activities (NDPA s.29) that describes today’s reality.
3. Assess high-risk processing before it ships (NDPA s.28).
4. Run the statutory clocks: 72 hours for breach notification (s.40), and the deadlines attached to data subject requests under Part V.
5. File or renew annually: the Compliance Audit Return for Ultra-High and Extra-High, registration renewal for Ordinary-High.

Each of those duties produces evidence, which is why the annual return asks where the evidence lives rather than whether you believe you are compliant. See our guides to the Compliance Audit Return, breach notification and RoPA for the detail.

If you are not sure, act designated

The cost asymmetry is stark. Building the registers and keeping them current costs an organisation working time it would mostly spend anyway. Being designated and unprepared costs a scramble every March, a harder audit, and exposure under the Act’s penalty regime described in our penalties guide. When the facts are unclear, act designated and confirm with the Commission or a licensed DPCO.