Registering as a data controller of major importance
Whether a Nigerian business is a data controller of major importance, which NDPC tier it falls in, what registration costs and who is left out.
By Achekam · · 4 min read · For Running a business businesses in Nigeria
Registration with the Nigeria Data Protection Commission (NDPC) is not for every business that holds personal data. It is for organisations the law calls data controllers or processors "of major importance". The phrase sounds as if it means large corporations, but the test reaches much further down: a busy clinic, a school, a growing online shop or a mid-sized hotel can all meet it.
This article walks through the NDPC's designation tests, the three tiers and their fees, who is expressly left out, what registration commits you to each year, and how to count the people whose data you hold.
The designation tests
The NDPC's Guidance Notice on registration, dated 19 December 2024, designates a data controller or processor as of major importance if it:
- keeps or has access to a filing system for personal data and processes the personal data of more than 200 data subjects in six months;
- provides commercial ICT services on other people's devices; or
- processes personal data in listed sectors such as financial, health, education, hospitality, insurance, oil and gas and e-commerce.
Any one test is enough. The first is the one most businesses should check carefully, because 200 people in six months is not many: customers, employees, job applicants and leads all count as data subjects. The Guidance Notice, which is also reproduced as a schedule to the NDPC's 2025 directive, is published as the NDPC's guidance notice on registration.
Three tiers and their fees
The Guidance Notice sorts organisations of major importance into three levels, each with its own registration amount:
| Tier | Who it covers, per the Guidance Notice | Amount payable |
|---|---|---|
| Ultra-High Level | commercial banks, telecommunication companies, insurance companies, multinationals, oil and gas companies, payment gateway providers, fintechs, and organisations processing personal data of over 5,000 data subjects in six months | N250,000 |
| Extra-High Level | government MDAs, micro finance banks, higher institutions, secondary and tertiary hospitals, mortgage banks, and organisations processing personal data of over 1,000 but less than 5,000 data subjects within six months | N100,000 |
| Ordinary High Level | primary and secondary schools, corporate training providers, primary health centres, independent medical laboratories, hotels and guest houses with fewer than 50 suites, and organisations processing personal data of over 200 but less than 1,000 data subjects within six months | N10,000 |
A business finds its tier either by what it is (a named type of organisation) or by how many people's data it processes. Check both: a small hotel might fit the ordinary-high description by type while its booking volume puts it higher by count. Where the two point to different tiers, ask the NDPC which applies before you pay.
Who is left out
The Guidance Notice says two groups are not data controllers of major importance: traders with fewer than 15 employees, and artisans who keep no specific filing system of customers' personal data beyond routine phone contacts, receipts and addresses. A tailor with a notebook of customers' numbers is outside; a tailor running a customer database for an online shop may not be.
Separately, under section 44(6) of the Act, the NDPC exempts certain bodies from registration as data controllers of major importance: community-based associations, faith-based organisations, foreign embassies and high commissions, judicial or adjudicatory bodies, and multigovernmental organisations.
Being outside registration does not take a business outside the Act itself. The duties to handle personal data lawfully still apply; see does the NDPA apply to you.
Once registered: renew, or file audit returns
What follows registration depends on the tier. Under the NDPC's 2025 directive, ultra-high and extra-high level organisations register once and file compliance audit returns annually, while ordinary-high level ones renew their registration every year and need not file an annual compliance audit return when they renew. The directive also requires notice to the NDPC of any significant change to registration information within sixty days.
So an ordinary-high level school renews each year; a hospital or a fintech files audit returns, as described in filing NDPA compliance audit returns.
Counting the people in your records
The tier tests turn on numbers of data subjects, so you need a defensible count. Count unique people, not records: one customer who bought ten times is one data subject.
If your business works in Achekam, two features help keep that count honest:
- Leads. Each new lead gets a code that is never reused, and when staff enter a lead whose e-mail or phone matches one already held, Achekam names the existing lead and asks before creating a second. That keeps duplicates out of the lead count. Leads can also be imported from CSV, up to 5,000 rows at a time.
- Staff. Employees can be added one by one or imported from a CSV file, and the import checks every row and writes all rows or none, so the staff count reflects a complete, checked list.
Add customers, suppliers' individual contacts and job applicants from wherever you keep them, then count the distinct people whose data you processed in the six-month window.
Keep the working: the sources you counted, the dates of the window and the total. Repeat the count each year, or sooner after a busy season or a marketing campaign, because a business that crosses into a higher band should move tiers rather than wait to be told.
Check the published list
The NDPC publishes an official list of data controllers and data processors of major importance, updated as the Commission approves them. Once you have registered, check that your organisation appears on it, and keep a dated copy of the entry with your registration receipt. If a partner or supplier claims to be registered, the list is where to confirm it.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
