A Data Protection Compliance Organisation sounds like a government office. It isn't one. It is a licensed private organisation that stands between your business and NDPC for one specific filing.
The short definition
A DPCO is a licensed Data Protection Compliance Organisation (DPCO). NDPC licenses these organisations to carry out audits and filings on behalf of the businesses that hire them.
Think of a DPCO as playing a role closer to an external auditor than a government department. It works for you, but it reports into NDPC's process.
Why the compliance audit return goes through one
Ultra-High and Extra-High Level organisations file a yearly compliance audit return, or CAR. Our guide to the CAR's deadline and fee covers that filing in full.
The rule requires this return to go through a DPCO, unless NDPC approves otherwise. That requirement exists so the audit behind the return carries some independent check, rather than a business simply declaring itself compliant.
Where to find a licensed one
NDPC publishes its list of licensed DPCOs alongside its registration services at services.ndpc.gov.ng. Checking that list before engaging a firm is worth the five minutes it takes.
A firm that markets itself as a DPCO but cannot point you to its own listing is a reason to slow down, not a reason to assume the paperwork will sort itself out later.
DPCO versus data protection officer
These two terms get confused often, but they are not the same thing. A data protection officer, or DPO, is a role inside your own organisation. Our guide on whether small businesses need a DPO covers that requirement separately.
A DPCO is an outside, licensed organisation you engage for the audit return itself. Some businesses need both a DPO and a DPCO relationship; smaller ones may need neither.
What to check before you engage one
Confirm the DPCO's licence status directly with NDPC's own list, not just the firm's marketing. Ask what the audit covers, what documents they will need from you, and how far ahead of the deadline they want to start.
Leaving this until the week before your CAR is due gives a licensed DPCO very little room to do the audit properly.
Common mistakes
- Confusing a DPCO with a government body. It is a private, licensed organisation, not part of NDPC itself.
- Assuming any consultant calling itself a DPCO is licensed. Check the published list directly.
- Leaving the engagement until the deadline is close. A rushed audit serves nobody well, least of all your own filing.
- Mixing up the DPCO and DPO requirements. One files your return; the other, where required, sits inside your business full time.
For the fee and deadline this organisation helps you meet, see the compliance audit return guide, and the SME regulators hub for the rest of NDPC's rules.