Registering with NDPC starts before you open the portal. The first job is working out whether you need to register at all.
Step 1: check whether you are of major importance
NDPC registration applies to a data controller or processor of major importance, meaning a business that processes personal data of more than 200 people in six months, or sits in a sector NDPC treats as high-risk regardless of size.
Our full explainer on who counts as major importance covers this test in detail. Skipping this step and registering blind tends to end in the wrong tier.
Step 2: work out your tier
NDPC sorts registered organisations into Ordinary-High, Extra-High and Ultra-High Level. Each tier carries a different fee and different duties afterwards.
Our guide to the fee at each tier walks through what separates them, so you are not guessing when the portal asks for this information.
Step 3: register at the portal
Registration itself happens at services.ndpc.gov.ng, under General Application and Implementation Directive (GAID) 2025. You will need your organisation's basic details and an honest answer on the data volumes that determine your tier.
General background on NDPC and its rules sits at ndpc.gov.ng, which is a separate address from the registration portal itself.
Step 4: pay the tier-appropriate fee
The fee due depends entirely on which tier you registered under. Paying the wrong amount for your actual tier is one of the more common reasons a registration gets queried.
Step 5: know what happens next
Ultra-High and Extra-High Level organisations move on to filing a yearly compliance audit return. Ordinary-High Level organisations instead renew their registration every year, without a separate audit return.
Updating your registration later
Business details change. You have within 60 days of the change to tell NDPC about a change that affects your registration.
If your business later stops qualifying as major importance altogether, you can ask to come off the register. Any fees already owed still need settling first, since dropping off the register does not clear a balance that built up while you were on it.
Common mistakes
- Registering before checking the major importance test. Some businesses register unnecessarily, and others that should register skip it by mistake.
- Mixing up the general website and the registration portal. Ndpc.gov.ng is where you read the rules; registration itself happens through the portal above.
- Letting a change sit unreported. The 60-day window starts from the change itself, not from when you get round to noticing it matters.
- Assuming registration is a one-time task for every tier. Only UHL and EHL treat it that way, and even they still file yearly after.
Once registered, see the compliance audit return deadline and fee if it applies to your tier, and the SME regulators hub for the rest of this series.