What "major importance" means
The NDPA defines a data controller or processor of major importance as one domiciled, resident or operating in Nigeria that processes, or intends to process, personal data of more than a number of data subjects the Commission prescribes, or that processes data of particular value or significance to the economy, society or security of Nigeria. The NDPC sets out the tiers, thresholds and fees in its guidance; banks, telecoms, insurers, hospitals, large employers and online platforms commonly fall within them.
Registering with the NDPC
Section 44 requires data controllers and processors of major importance to register with the Commission, and to notify it of significant changes to the details registered. Registration is made through the NDPC's online portal and renewed as the Commission requires. Prepare:
- The organisation's details and the name and contact details of its DPO
- A description of the personal data and the categories of data subjects
- The purposes of processing and the recipients
- Any transfers outside Nigeria and their safeguards
- A description of the technical and organisational security measures
The duties that follow
- Appoint a data protection officer with expert knowledge of data protection law (section 32)
- Carry out DPIAs for high-risk processing (section 28)
- File annual compliance audit returns with the NDPC, as the GAID requires
- Face the higher maximum penalty: the greater of ₦10 million or 2% of annual gross revenue
hlola keeps the registration, DPO appointment and audit evidence on one Nigeria readiness card, with renewal and filing dates as tasks.
Common questions
Who must register with the NDPC?
Data controllers and data processors of major importance, under section 44 of the Nigeria Data Protection Act, 2023.
Do data controllers of major importance need a DPO?
Yes. Section 32 requires them to designate a data protection officer.
What penalty applies to data controllers of major importance?
The higher maximum amount: the greater of ₦10 million or 2% of annual gross revenue in the preceding financial year.
This guide explains the law in general terms and is not legal advice. Laws, regulations and regulators' guidance change; confirm how they apply to your organisation with qualified counsel. Last reviewed 25 October 2026.