Pricing
Priced against your designation, not your headcount.
What an organisation owes under the NDPA is driven by its designation and the scope of its processing, so that is what we price against. Plans are invoiced annually in naira, and we quote after a short scoping call rather than publishing a number that would be wrong for most of the organisations reading it.
Register
Ordinary-High Level organisations that must maintain a defensible record and renew registration annually.
- Guided onboarding and a first record of processing activities
- RoPA, processor register and transfer register
- Data subject request queue with statutory clocks
- Breach register with the 72-hour notification clock
- Evidence vault with obligation mapping
- Two named users, email support
No audit return preparation.
Request a quoteReturn
Extra-High and Ultra-High Level organisations carrying the annual Compliance Audit Return.
- Everything in Register
- CARPath: Schedule 2 mapping, readiness view and gap tasks
- Return assembly, evidence index and structured export
- Impact assessment workflow with scoring and sign-off
- Quarterly readiness review with your data protection officer
- Coordination with your licensed DPCO, or an introduction to one
- Ten named users, priority support
Most organisations that file a return start here.
Request a quoteGroup
Holding structures, groups with multiple registered entities, and DPCOs managing a portfolio of clients.
- Everything in Return, across multiple entities
- Entity-level separation with consolidated group reporting
- Portfolio view of readiness and filing status by entity
- Single sign-on and role-based access
- Nigerian data residency, with an EU region available
- Named account contact and onboarding for each entity
Priced per entity, with volume terms for DPCO portfolios.
Request a quoteWhat sits outside the licence
Costs we do not absorb, and will not hide.
Two things are commonly confused with a software subscription. Neither is included in any Estreat plan, and both are paid to third parties rather than to us.
Regulatory fees
Registration, renewal and audit return fees are set by the Nigeria Data Protection Commission and paid to the Commission. Late filing attracts a surcharge on the applicable fee.
DPCO audit and filing
The audit opinion and the filing itself are performed by a Data Protection Compliance Organisation licensed by the Commission, on its own commercial terms. Estreat prepares the pack the DPCO audits.
Commercial terms
The questions procurement asks first.
Currency and invoicing
Invoiced in naira, annually in advance, by a Nigerian company. No foreign exchange exposure and no offshore remittance for a domestic buyer.
Term
Twelve months, aligned to your filing year rather than to your purchase date, so the renewal never lands in the middle of your return.
Design partners
A limited number of early customers work with us on preferential terms in exchange for structured feedback and a reference. Ask about this on the call.
Your data on exit
Your record is exportable in a structured format at any time during the term and on termination. Compliance records outlive vendors, and pricing leverage should not come from holding them.
Onboarding
Included. Onboarding is a working session that produces your first record, not a professional services line item.
Data processing terms
Our data processing addendum is published rather than negotiated late. Read it at the DPA.
Tell us your designation and we will quote.
Your level, the number of registered entities and roughly how many data subjects you process is enough for a firm number.