Can an accounting firm file a client's NDPA audit return?
Whether a Nigerian accounting firm can prepare and file a client's NDPA compliance audit return or a licensed DPCO must, and how the firm can help.
By Achekam · · 4 min read · For Accountants & audit firms in Nigeria
Clients ask their accountants about everything with "audit" or "return" in its name, so it is no surprise that Nigerian firms are being asked about the Nigeria Data Protection Act's compliance audit returns. The client has heard there is a deadline, assumes it is a kind of audit, and asks whether the firm can do it alongside the financial statements.
The honest answer is that the firm can help a great deal, but a firm that is not a licensed Data Protection Compliance Organisation cannot provide what the Nigeria Data Protection Commission requires at the end of the process. This article explains where that line sits, when the returns are due, and how an accounting firm can support a client without overstepping it.
Only licensed DPCOs verify compliance audit returns
The NDPC says Compliance Audit Returns are filed with the Commission through a licensed Data Protection Compliance Organisation, and that only licensed DPCOs can provide a competent verification statement on Compliance Audit Returns. The point is set out in the NDPC's frequently asked questions.
The NDP Act General Application and Implementation Directive, the GAID 2025, says the same for the larger organisations. Under it, Ultra-High Level and Extra-High Level data controllers and processors must file Compliance Audit Returns through a DPCO licensed by the NDPC, unless the Commission approves otherwise.
So for an accounting firm the question is not whether it is competent in audit work generally. It is whether it holds an NDPC licence as a DPCO. Without one, it cannot give the verification statement and cannot be the channel through which the return is filed.
When returns are due
The GAID 2025 sets two kinds of timing. First, a data controller or processor is expected to conduct an NDP Act compliance audit within 15 months of commencement of business and annually thereafter. Second, for filing: a data controller or processor of major importance established before 12 June 2023 must file its Compliance Audit Returns by 31 March each year, and one established after that date must file within 15 months of its establishment and annually thereafter. The GAID applies the 31 March filing to Ultra-High and Extra-High Level organisations, and the returns are filed on the NDPC's automated portal.
| Client | Audit | Filing |
|---|---|---|
| Any data controller or processor | Within 15 months of commencement, then yearly | — |
| Of major importance, established before 12 June 2023 | Yearly | By 31 March each year |
| Of major importance, established after 12 June 2023 | Yearly | Within 15 months of establishment, then yearly |
Diary 31 March well ahead: the DPCO needs time to do its own work before it can verify and file.
A worked example in words. A retail client established before June 2023 is designated as of major importance. Its return is due by 31 March. Working backwards, the DPCO needs the evidence in hand some weeks before that, which means the firm's evidence request should go out around the turn of the year, with a reply date in January. A client that starts in March has left its DPCO no room.
What the NDPC licenses and receives
The NDPC provides online registration for data controllers and processors, licenses DPCOs, and receives the audit compliance returns. A client therefore deals with the Commission in two capacities: as a registered controller or processor, and as the subject of a return filed through its DPCO. The detail of the returns themselves is in NDPA compliance audit returns.
Support a firm that is not licensed can give
A great deal of the work behind a compliance audit is the kind of work accountants do well: gathering records, testing that processes run as described, and organising evidence. Without a DPCO licence, an accounting firm can still:
- help the client identify which personal data it holds and where, starting from payroll, customer and supplier records the firm already knows;
- collect and organise the evidence a DPCO will ask for;
- check that the client's dates are diarised: the audit, the filing and the DPCO's fieldwork;
- act as the client's coordinator with the DPCO, if the client wants that.
What it should not do is describe its own work as the compliance audit, sign anything presented as a verification statement, or file the return. Put that boundary in the engagement letter, in plain words.
Collecting the client's evidence through requests
In Achekam, staff can create, send and track requests to clients for documents, answers and confirmations in one RFI console, whichever screen the request was raised from. A data protection evidence request can be built once and sent to each client that wants the service: privacy notices, consent records, data processing agreements with suppliers, records of data subject requests, and the client's NDPC registration.
As the evidence arrives, it belongs in the client's folder in the Document Centre, where staff can upload files and folders, keep versions, tag, archive and restore with a reason, and search. Tagging each item by the area it supports lets the firm hand the DPCO an organised set rather than a pile of attachments.
Referring and coordinating with a DPCO
The cleanest arrangement is a three-way one. The client appoints a licensed DPCO for the audit and the return. The accounting firm, with the client's agreement, gathers and organises the evidence and keeps the dates. The DPCO performs its audit, provides the verification statement and files through the NDPC's portal.
Before referring, check the DPCO's licence with the NDPC and record that check on the client file. And if the firm is itself a data controller of major importance, it has its own obligations to think about; see an accounting firm's own NDPA registration.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
