Not every business needs a named data protection officer. Whether you do comes down to the same test that decides your NDPC registration.
What the law actually requires
A data controller or processor of major importance must appoint a Data Protection Officer with expert knowledge of data protection law and practice. This comes directly from the Nigeria Data Protection Act, and NDPC's June 2026 notice restates it plainly.
The role is not decorative. It carries real duties: reporting to management, giving a twice-yearly data protection report, and having its contact details published and sent to NDPC.
Who this duty actually applies to
The trigger is the same major importance test behind NDPC registration itself. If your business processes personal data of more than 200 people in six months, or sits in a sector NDPC treats as high-risk by default, the DPO requirement applies to you.
Our guide on who counts as major importance covers that test in full, since it decides several NDPC duties at once, not just this one.
What the role actually needs
The standard is expertise, not a job title. GAID 2025 allows the DPO to be existing staff or someone engaged on a service contract, provided they carry real knowledge of data protection law and practice.
The DPO cannot be penalised for doing the job properly. That protection exists so the role has some independence from ordinary management pressure.
The yearly training expectation
NDPC's June 2026 notice sets a yearly target of at least 20 CPD points, out of 40 available, with a portion required from structured training rather than informal learning. Falling short can lead to a temporary inactive status for the DPO.
That detail matters if your named DPO is a shared or part-time resource. Track their training the way you would track any other compliance deadline.
What a business below the threshold can do instead
If your business sits below the major importance line, this specific appointment duty does not apply to you. That is not the same as having no responsibility for the data you hold.
A basic privacy policy checklist is a reasonable starting point, alongside good habits like limiting who can access customer records.
Common mistakes
- Appointing a DPO in name only. The role needs real knowledge and real independence, not just a title on an organisation chart.
- Forgetting the twice-yearly report to management. This is a standing duty, not a one-off task at appointment.
- Letting CPD points lapse. A DPO who falls behind risks an inactive status that leaves the role effectively unfilled.
- Assuming small size always means no duty. Sector-based triggers apply regardless of headcount.
For the related filing this role often supports, see what a DPCO is and how it differs from a DPO, and the SME regulators hub for the rest of this series.