NDPA Enforcement in 2026: Lessons from NDPC Fines & the Compliance Audit Return Deadline
The Nigeria Data Protection Commission has shifted from education to enforcement — and the numbers show it. Here's what recent fines mean for your compliance programme.
From warnings to enforcement
The Nigeria Data Protection Commission (NDPC) has described its own approach in three phases: warnings and education (2019–2023), investigations and fines (2024–2025), and now full enforcement mode (2026 onward). Since intensifying enforcement of the Nigeria Data Protection Act (NDPA) 2023, the NDPC has collected an estimated ₦7.2 billion from registrations, compliance revenue and fines.
Notable recent fines
- MultiChoice Nigeria was fined ₦766,242,500 in July 2025 for the illegal cross‑border transfer of Nigerians' personal data.
- In 2024, four banks and three other companies were fined a combined ₦400 million for data protection violations.
These cases signal that cross‑border data transfers and sector heavyweights are squarely within the NDPC's enforcement focus — size and profile are not a shield.
The August 2025 compliance notice
On 25 August 2025, the NDPC issued a compliance notice to 1,368 organisations operating in Nigeria, giving a 21‑day window to report on their compliance status. The Commission has publicly stated its intent to intensify enforcement and act against non‑compliant organisations.
The Compliance Audit Return (CAR) deadline
Registered data controllers and processors are required to file Compliance Audit Returns (CARs). The deadline for 2025 CARs was originally set for 31 March 2026 and has since been extended to 30 May 2026 per NDPC notices. If your organisation is registered with the NDPC, treat this as a hard, near‑term deadline rather than an afterthought.
What non‑compliance can cost
Under the NDPA, the penalty for non‑compliance by a data controller or processor is a fine of up to ₦10,000,000, or 2% of the annual gross revenue of the preceding financial year — whichever is greater. For larger organisations, the percentage‑of‑revenue basis can dwarf the naira cap, as the MultiChoice fine illustrates.
Compliance action plan
- Confirm your organisation's NDPC registration status — register now if you haven't.
- File your 2025 Compliance Audit Return before the 30 May 2026 deadline (or confirm the current deadline with us, as extensions have happened before).
- Review any cross‑border data transfer arrangements — this is a proven enforcement priority.
- Run or refresh a data protection audit: data mapping, RoPA, vendor DPAs and breach‑response readiness.
- Confirm you have a functioning Data Protection Officer function, whether in‑house or outsourced.
Quick FAQs
Has the CAR deadline already passed?
The 2025 CAR deadline was extended from 31 March to 30 May 2026. Given the NDPC's pattern of notices and extensions, confirm the live deadline with us or the NDPC before assuming it has closed.
Are only large companies at risk of fines?
No — while MultiChoice and several banks made headlines, the NDPC's 2025 compliance notice went out to 1,368 organisations of varying sizes, and the penalty structure (up to 2% of gross revenue) applies broadly.
What triggered the MultiChoice fine specifically?
It related to the illegal cross‑border transfer of personal data of Nigerians — a reminder that transfer mechanisms and safeguards need particular attention.
Need help?
This guide is for general information only and does not constitute legal advice — see our Disclaimer. For advice tailored to your business, get in touch.
Key Sources
- Nigeria Data Protection Act, 2023.
- Nigeria Data Protection Commission (NDPC) — enforcement notices and compliance audit return guidance.
Last updated: July 2026. Laws and enforcement practice in this area are moving quickly — please confirm current status with us before relying on any specific figure or deadline.