Registering with NDPC is not a one-time task you file away. Your details on the register need to stay accurate afterwards.
What counts as a reportable change
A change that affects what NDPC holds about your organisation is the kind that needs reporting. That includes a change in structure, contact details, or the data protection officer named on your registration.
A shift in how much personal data you process, enough to move you between tiers, also falls into this category. Growing from Ordinary-High to Extra-High Level, for example, is not something to leave unreported.
The window to report it
NDPC's rule gives a registered organisation within 60 days of the change to update its details. That clock starts from the change itself, not from whenever someone in the business gets round to noticing it.
Updates go through the same portal used for the original registration, services.ndpc.gov.ng.
What happens if you no longer qualify
A business can grow into major importance, and it can also grow out of it, or restructure in a way that removes the trigger entirely. When that happens, an organisation can ask NDPC to remove it from the register.
Coming off the register does not erase any fees that built up while you were on it. Settle those first, since the removal itself does not cancel a balance already owed.
Keep a simple written record of when your status changed and why. If NDPC or a bank ever asks why your registration ended, a dated note beats trying to reconstruct the reasoning months later.
Why this matters more than it looks
A registration that no longer reflects your actual business is a liability in two directions. It can leave you paying for a tier you have outgrown, or worse, leave you under-registered if your data handling has grown past what your current tier assumes.
Our guide to the tiers and their fees is worth rereading if you suspect your business has moved between bands since you first registered. A short yearly check against that guide is a habit worth building into your own compliance routine.
Common mistakes
- Only updating details when convenient. The 60-day window is the standard to work to, not a soft suggestion.
- Forgetting a tier change counts as a reportable change. Growth in your data volumes is exactly the kind of shift NDPC's register needs to reflect.
- Assuming deregistration clears old fees. It does not. Settle what you owe first.
- Letting the named data protection officer go stale on the register. If that person leaves the business, the register should say so.
For the registration process itself, see how to register with NDPC, and the SME regulators hub for the rest of this series.