Not every business that holds customer data needs to register with the Nigeria Data Protection Commission (NDPC). The ones that must are called data controllers or processors "of major importance".
The test NDPC actually uses
The main test is about scale. A business counts as a controller or processor of major importance if it processes personal data of more than 200 people in six months.
This is not about how big your company is in general. A five-person business with a large customer database can cross this line. A fifty-person business with almost no customer records might not.
Some sectors count regardless of size
NDPC's guidance also names a number of sectors that count as major importance no matter how few people's data they hold. Finance, health and e-commerce are among them, alongside several others set out in the guidance notice itself.
If your business sits in one of these named sectors, the 200-person test does not save you from registering. Check the full list on services.ndpc.gov.ng rather than assuming your sector is safe by size alone.
Who NDPC says is not of major importance
NDPC's guidance also draws a line the other way. Traders with fewer than 15 employees and artisans who keep no customer records beyond routine contacts and receipts sit outside the definition, along with traders and artisans who do not pass personal data on as part of their business.
Social media communities of friends or professionals are excluded too. Faith-based organisations, community associations, embassies, courts and multigovernmental bodies are exempt from registration entirely.
Why the label matters
Being of major importance is what triggers NDPC registration at all. It also decides which tier you register under: Ordinary-High, Extra-High or Ultra-High Level, each with its own fee and its own ongoing duties.
Our guide to NDPC's registration fees by tier covers what each tier actually costs once you know you need to register. Getting the label right first saves you from registering under the wrong tier and having to correct it later.
Common mistakes
- Judging by company size instead of data volume. A small business with a large customer list can still cross the threshold.
- Missing a sector-based trigger. Businesses in named sectors count regardless of the 200-person test.
- Assuming a spreadsheet doesn't count as a filing system. NDPC's guidance covers a filing system in either paper or digital form.
- Guessing rather than checking the guidance directly. The exact wording on services.ndpc.gov.ng is worth reading once, rather than relying on a summary alone.
What to do next
Work out honestly which side of the test your business sits on. If you are of major importance, see how to register with NDPC and what registration costs by tier. For the rest of this series, visit the SME regulators hub.