Navigate data protection with certainty.
Assess, document and prove compliance with the NDPA. One platform for corporate entities and small businesses, where every conclusion cites the section it comes from.
- Section-level citations
- Nothing assumed
- Built for the NDPA 2023
95
provisions in the knowledge base
62
controls mapped to sections
41
notices, policies and generators
72h
breach clock to the Commission
- Built on
- NDPA 2023
- GAID 2025
- ISO/IEC 29134 DPIA
- ISO 31000 risk scoring
- EDPB DPIA criteria
Coverage across the Act
See it work
From a question to a defensible answer.
Three core workflows, each tied back to the provisions of the Act.
Who it is for
One Act. Three perspectives.
Whether you hold the data, own the data or advise on it, you get the view of the Act that matters to you.
No account needed
Individuals
Understand your rights under the Act, send a request to an organisation, track it, and learn how to complain to the Commission.
Know your rightsControllers and processors
Corporate entities
Run control assessments, complete DPIAs, manage breaches and rights requests, and give each team member the right level of access.
Request a workspaceWhat is inside
Every tool a compliance programme needs.
From a first question to an audit-ready file, each module is tied back to the provisions of the Act.
Assessment and audit
Controls mapped to sections, scored 0 to 4, with maturity level, readiness verdict and a phased roadmap.
Document Studio
A privacy notice generator for any use case plus notices and organisational policies. Facts you do not supply stay visible as placeholders.
DPIA engine
Screening, risk scoring with mitigations, and a prior-consultation flag.
Data minimisation
Tests every collected field against its purpose and suggests remove, make optional or restrict.
Breach 72 hour clock
Risk grading, whether the Commission and individuals must be told, and the deadline.
Notice checker
Paste a privacy notice and see which required elements are missing.
Cross-border transfers
Tests a transfer against the Act and lists conditions and actions.
Rights request portal
A public portal per organisation, an inbox, and a tracker for the requester.
Penalty exposure
Ceiling under section 48 for your revenue and importance level.
How it works
From first question to audit-ready evidence.
Four steps, each producing a record you can show the Commission, your board or your auditor.
- 1
Assess
Answer a questionnaire built from the Act. Every control maps to the section it comes from.
Maturity score and readiness verdict
- 2
Prioritise
Each gap becomes a finding scored for likelihood and impact on a 5 by 5 risk matrix.
Risk-rated findings
- 3
Remediate
Run DPIAs, generate notices and policies, and work through a phased roadmap with owners and dates.
Remediation roadmap
- 4
Prove
Download branded reports and keep a record of every assessment, DPIA, breach and rights request.
Audit-ready evidence
The Act at a glance
The obligations regulators check first.
Each one is built into the platform, with the section of the Act it comes from.
72h
Breach notification
Tell the Commission within 72 hours of becoming aware of a breach likely to put people at risk.
s40(2)DPIA
Before high-risk processing
Assess the risk to individuals before processing likely to be high risk starts.
s28(1)DPO
Major importance
Controllers of major importance must designate a Data Protection Officer.
s32(1)-(2)60 days
Registration changes
Registered controllers and processors must notify significant changes within 60 days.
s44(3)-(6)2%
Maximum penalty
Up to the greater of 10 million naira and 2% of annual gross revenue for major importance.
s48(3)-(5)- 01
Curated from the Act
Answers come from a knowledge base built from the text of the Nigeria Data Protection Act, 2023, matched by rules and retrieval.
- 02
Citations are checked
If an AI key is configured, a language model composes the narrative, and it is discarded if it cites any section that was not supplied to it.
- 03
No invented facts
Where the Act sets no fixed number, for example the time to answer a rights request, the platform says so and treats your figure as an internal target.
Questions
The NDPA, answered plainly.
Short answers to the questions organisations ask most, each tied to the section of the Act.
Who does the Nigeria Data Protection Act 2023 apply to?
It applies to the processing of personal data, by automated means or not, where the controller or processor is domiciled in, resident in or operating in Nigeria, where the processing happens in Nigeria, or where a controller or processor outside Nigeria processes personal data of a data subject in Nigeria.
s2(1)s2(2)
How quickly must a personal data breach be reported to the Nigeria Data Protection Commission?
Within 72 hours of becoming aware of a breach that is likely to result in a risk to the rights and freedoms of individuals. Where the risk is high, the affected individuals must also be told. NDPA Compass runs the 72 hour clock from the moment of awareness and grades the risk for you.
s40(2)s40(3)
When is a data protection impact assessment (DPIA) required?
Before processing that is likely to result in a high risk to the rights and freedoms of individuals because of its nature, scope, context and purposes. If the DPIA shows high risk that cannot be reduced, the Commission must be consulted before processing starts. The NDPA Compass DPIA follows ISO/IEC 29134 and the EDPB criteria and covers everything section 28(4) requires.
s28(1)s28(2)s28(4)
Do we need a Data Protection Officer?
A data controller of major importance must designate a Data Protection Officer with expert knowledge of data protection law and practice. The DPO can be an employee or engaged under a service contract, and advises the organisation, monitors compliance and is the contact point for the Commission.
s32(1)-(2)s32(3)
Do we have to register with the Commission?
Data controllers and processors of major importance must register with the Commission, and notify significant changes to the registered information within 60 days.
s44(1)s44(3)-(6)
What are the maximum penalties under the NDPA?
For a controller or processor of major importance, the greater of 10 million naira and 2% of annual gross revenue in the preceding financial year. For others, the greater of 2 million naira and 2% of annual gross revenue. The Commission can also order a violation to be remedied and compensation to be paid.
s48(1)-(2)s48(3)-(5)
Can personal data be transferred outside Nigeria?
Only where the recipient is subject to a law, binding corporate rules, contractual clauses, a code of conduct or a certification mechanism that gives an adequate level of protection, or where one of the conditions in section 43 applies.
s41(1)s43(1)
Is NDPA Compass legal advice?
No. NDPA Compass gives automated guidance drawn from the text of the Act, with every conclusion cited to its section, and says so when the Act does not settle a point. For decisions with legal consequences, take advice from a qualified professional.
Start your compliance programme today.
Create a workspace for your organisation, run your first assessment and get a phased roadmap mapped to the Act.