Outsourcing payroll, hosting or customer support does not remove your NDPC obligations. It can add one more fee to track.
Controller versus processor, quickly
A controller is the business that decides why personal data is collected and how it's used. Your company, deciding to keep a customer database, is acting as a controller.
A processor is whoever handles that data on the controller's instructions instead of its own. A payroll bureau running your staff payments, or a cloud host storing your customer records, is typically acting as a processor.
The fee this creates
NDPC's guidance sets a fee of ₦5,000 per processor every 12 months for a UHL controller's use of a data processor. This sits on top of the controller's own ₦250,000 registration fee. The guidance available doesn't confirm whether an OHL or EHL controller faces the same per-processor charge, so confirm directly with NDPC if you register at one of those tiers.
It is a per-processor charge. A business using two separate outside companies to process data on its behalf can see this fee apply twice.
When it is not due again
The guidance carves out two situations where the fee doesn't repeat within the same 12 months. One is when the work moves to a new processor during that window. The other is when the controller has already paid the OHL renewal for its processors.
Read that second exception carefully rather than assuming it applies by default. If you are unsure whether your arrangement fits either exception, confirm with NDPC or a data protection lawyer before assuming you're covered.
Why this catches businesses out
Many small and mid-sized businesses outsource exactly the kind of work this fee targets: payroll, IT support, customer service, email marketing. None of that feels like a "data protection" decision at the time.
Each of those relationships can count as a processor arrangement once personal data is involved. Mapping out who touches your customer or staff data, and under what instructions, is the first step to knowing whether this fee applies to you at all.
Write the list down rather than keeping it in your head. A short table of each outside company, what data it touches, and why, makes this fee easy to check against, and doubles as a useful record if NDPC or a customer ever asks how their data is handled.
Common mistakes
- Assuming only tech companies count as processors. A payroll bureau or a courier handling delivery addresses can count too.
- Forgetting the fee sits alongside your own registration fee, not instead of it. Our guide to the tiers covers your own fee separately.
- Not tracking which processors you actually use. A business with several outsourced functions can lose track of how many separate relationships this fee touches.
- Assuming the 12-month exception always applies. Check the specific wording rather than assuming a processor switch is automatically free.
- Never revisiting the list once it's written. New tools and outside contractors get added to a growing business often enough that a yearly recheck is worth the time.
For the wider registration picture this fee sits inside, see the SME regulators hub and how to register with NDPC.