Questions and answers

Almost certainly. The Nigeria Data Protection Act 2023 applies to any organisation that processes the personal data of people in Nigeria, from a two-person startup to a bank. There is no size or revenue threshold that exempts a business.

An organisation is a data controller or processor of major importance if it processes the personal data of more than 200 people in six months, or works in a listed sector such as financial services, health, education, communication or e-commerce (NDPC Guidance Notice, GAID 2025 Schedule 7). It must register with the NDPC. The larger tiers (UHL and EHL) also file an annual Compliance Audit Return; the smallest tier (OHL) renews its registration each year instead. As of early 2026, more than 38,677 organisations had registered.

Under section 48 of the NDPA, the NDPC can impose a penalty of up to ₦10 million or 2% of the previous year's annual gross revenue, whichever is greater, on a data controller or processor of major importance. For other organisations the limit is ₦2 million or 2%, whichever is greater.

The NDPC has used this power. It fined MultiChoice Nigeria ₦766 million in July 2025, Fidelity Bank ₦555.8 million in August 2024 and Meta $32.8 million in February 2025, a dispute later settled in court. See the enforcement tracker for the details and sources.

Organisations of major importance in the UHL and EHL tiers file their annual Compliance Audit Return through a Data Protection Compliance Organisation (DPCO) licensed by the NDPC (GAID 2025 Art. 10(14)). As of early 2026, the NDPC had licensed 317 DPCOs.

Izini does not replace your DPCO or your lawyer. It does the repetitive work (the cookie banner, the records, the request log, the breach file, the evidence) so your DPCO, DPO or lawyer, if you use one, reviews a finished file instead of chasing paperwork.

Yes. Every paid plan includes a guided setup session in which our team configures your cookie banner, privacy policy and records with you. Adding the banner to your website is a single script that your web agency can paste in, or load through Google Tag Manager.

Day to day, Izini is used by whoever looks after compliance: an owner, an operations lead, HR or a DPO. The developer tools are there if you have a technical team, but you do not need them.

Where a breach is likely to put people's rights at risk, you must notify the NDPC within 72 hours of becoming aware of it (NDPA section 40(2)). Izini starts the 72-hour clock when you log the incident, helps you decide whether the threshold is met, and keeps a timed record of every step.

The Compliance Audit Return (CAR) is the annual filing that shows the NDPC how you collect, use and protect personal data. It is due by 31 March each year and is filed through a licensed DPCO. As of early 2026, more than 8,155 returns had been filed.

Izini collects the evidence as you work during the year and assembles it into one pack for your DPCO.

The NDPA gives people the right to ask for their data, to correct it, to have it deleted and to take it elsewhere (sections 34 to 38). It asks you to respond without unreasonable delay, but it does not set a fixed number of days. Izini tracks each request against a 30-day target and reminds you before it runs late, so you can show you answered promptly.

Izini is designed not to hold your customers' names, email addresses or phone numbers. Consent records use a random device ID or your own customer ID, and requests from your systems use your reference, not the person's details. Izini refuses an email address, phone number or card number sent as an identifier.

Random and hashed IDs can still count as personal data under the NDPA, so we cover them in our Data Processing Agreement.

A banner that only shows a message does not prove anything. Under the NDPA the burden of proving consent is on you (section 26). Izini records each choice with the date and time, only lists cookies your site really sets, holds back non-essential scripts until people agree, and speaks five Nigerian languages.