The compliance audit return, or CAR, is the yearly filing that keeps a UHL or EHL organisation's NDPC registration current.
Who files a CAR
Ultra-High Level and Extra-High Level organisations file a CAR every year. Ordinary-High Level organisations do not; they renew their registration every year instead, with no separate audit return to file.
If you are not sure which tier you sit in, our guide to the tiers and their fees covers the difference first.
The deadline
The standing rule is that a CAR is due by 31 March each year. For the 2025 return, NDPC moved that date to 30 May 2026.
A newly registered UHL or EHL organisation gets a different starting point: its first return is due within 15 months of its establishment. After that first return, the usual yearly date applies.
The filing fee by tier
The fee depends on your tier and, within EHL and UHL, on how much data you process. Here is the schedule as NDPC has published it.
| Tier | Data volume | Filing fee |
|---|---|---|
| EHL | Below 2,500 | ₦100,000 |
| EHL | Middle band | ₦200,000 |
| EHL | 10,000 or more | ₦250,000 |
| UHL | Below 25,000 | ₦500,000 |
| UHL | 25,000 to 50,000 | ₦750,000 |
| UHL | Above 50,000 | ₦1,000,000 |
NDPC's own schedule does not spell out the exact boundary of the EHL middle band as clearly as the other rows. If your data volume sits close to a boundary, confirm your exact fee on the portal before filing rather than estimating from this table alone.
Filing through a DPCO
A CAR is filed through a licensed Data Protection Compliance Organisation (DPCO), unless NDPC approves a different arrangement. A DPCO is a separate, licensed organisation, not a role inside your own company, and NDPC publishes the list of licensed ones on its registration portal.
Choosing one is worth doing early, rather than in the final week before the deadline. A DPCO handling several clients' returns at once has its own busy period around the deadline.
What a late return costs
Missing the deadline adds 50% of the CAR filing fee, on top of the fee. That is on top of the filing fee itself, not instead of it.
Common mistakes
- Filing as an OHL organisation by mistake. OHL does not file a CAR at all; check your tier before starting the process.
- Using last year's deadline without checking for an extension. The 2025 return's date moved once already.
- Guessing the fee band instead of confirming it. The middle EHL band in particular is worth confirming directly rather than assumed.
- Filing without a DPCO when the rule requires one. Confirm whether your case needs NDPC's separate approval to file another way.
For your other yearly filings alongside this one, use the compliance calendar. The SME regulators hub covers the rest of NDPC's requirements.