An appraisal of the Nigeria Data Protection Commission’s (NDPC's) Guidance Notice for Mandatory Filing of Compliance Audit Returns (CARs)

Given the rapid technological advancement and the increasing importance of data in our modern world, the year 2023 witnessed a significant development in the protection of personal data in Nigeria with the signing into law of the Nigeria Data Protection Act, (“NDPA”) in June 2023. Inter alia, the Act provides for a legal framework for protecting personal information, it establishes the Nigeria Data Protection Commission (“NDPC” or “Commission”) to regulate the processing of personal information; and it contains a transitioning framework that ensures that all regulations, licenses, or orders issued by the defunct Nigeria Data Protection Bureau (NDPB) and National Information Technology Development Agency (NITDA) remain in force until they are repealed, replaced, reassembled, or altered. As a result of this, filing of Data Protection Compliance Audit Returns (CAR), which is an obligation for data controllers and data processors under the Nigeria Data Protection Regulation (NDPR) 2019, is preserved by the new law. Noting that a new cycle of CAR filing will commence in 2024, the Commission published a Guidance Notice prescribing the formalities for the CAR filing and other pertinent compliance requirements for data controllers moving forward (the “Notice”). This paper summarizes key points for data controllers and processors to take note of from the Notice.

在科技飞速进步、数据在当代社会重要性与日俱增的背景下，尼日利亚于2023年6月正式签署《尼日利亚数据保护法案》（Nigeria Data Protection Act，NDPA），该国个人数据保护领域由此迎来重大发展。该法案除其他规定外，确立了个人信息保护的法律框架；设立尼日利亚数据保护委员会（Nigeria Data Protection Commission，NDPC，简称“委员会”）以监管个人信息处理活动；同时配套过渡框架，确保原由已撤销的尼日利亚数据保护局（Nigeria Data Protection Bureau，NDPB）与国家信息技术发展局（National Information Technology Development Agency，NITDA）发布的所有法规、许可或命令在被废止、替换、重组或修改前持续有效。受此影响，《2019年尼日利亚数据保护条例》（Nigeria Data Protection Regulation 2019，NDPR）规定的数据控制者与数据处理者需提交数据保护合规审计申报书（Data Protection Compliance Audit Returns，CAR）的义务，在新法中得以保留。鉴于新一轮CAR申报工作将于2024年启动，委员会发布了一则指导公告（以下简称“《公告》”），明确了CAR申报的办理流程及数据控制者后续需遵守的其他相关合规要求。本文梳理了数据控制者与数据处理者需从该《公告》中关注的核心要点。