Board Governance
Briefing
The NDPA places board-level accountability for data protection governance on every Data Controller and Processor of Major Importance. Most boards have acknowledged this accountability. Very few have structured the governance framework required to discharge it — or have considered what happens when the NDPC asks a board member to account for the organisation's compliance posture.
Regulatory Updates
Analysis
Compliance Audit Returns are mandatory for all DCPMI-classified organisations — and must be prepared and certified by a licensed DPCO. Most organisations that are legally obligated to file a CAR have not yet done so. This analysis sets out what the CAR requires, what the NDPC expects, and what organisations must have in place to support a clean certification and filing.
Privacy & Data Protection
Operational Guide
Data Protection Impact Assessments are legally required under NDPA Section 28 before high-risk processing commences — not as a one-time compliance exercise but as a standing operational discipline embedded in the project and procurement lifecycle. Most organisations that have conducted DPIAs have treated them as singular events. This analysis examines what an operational DPIA programme looks like, and how to build one that survives an NDPC inspection.
Digital Trust
Strategic Insight
Digital trust is not a marketing position — it is a governance framework that can be measured, structured, and reported. The ISACA Digital Trust Ecosystem Framework provides a seven-domain architecture for institutions that want to move from acknowledging digital trust accountability to governing against it. This analysis examines how regulated Nigerian institutions can operationalise digital trust using the DTEF — and what board-level governance of digital trust actually requires in practice.
Assurance & Audit
Practitioner Analysis
The NDPC's inspection framework does not test for the existence of compliance policies — it tests for the existence of compliance evidence. This practitioner analysis maps the specific evidence items that NDPC inspectors request, the documentation format they expect to find, and the common evidence gaps that produce adverse inspection findings. Written from the experience of conducting NDPA compliance audits and preparing organisations for regulatory engagement.
✺
Coming Soon
New insights published regularly. Subscribe for notification when new analysis is available.
Subscribe →