D1
Registration & Classification
NDPC registration status and DCPMI classification under GAID 2025.
D1Registration & Classification
D2Lawful Basis & Consent
D3Privacy Notices
D4Data Subject Rights
D5Data Protection Officer
D6Data Security Measures
D7Breach Management
D8Compliance Audit Returns
D1Registration & Classification
D2Lawful Basis & Consent
D3Privacy Notices
D4Data Subject Rights
D5Data Protection Officer
D6Data Security Measures
D7Breach Management
D8Compliance Audit Returns
NDPA 2023 Compliance Assessment
Is Your Business Ready
for the NDPA 2023 Act?
Nigeria's Data Protection Act 2023 is in active enforcement. Thousands of organisations have already received compliance notices. This free assessment tells you exactly where your business stands across all 8 domains, and what to fix first.
Aligned with NDPA 2023 and GAID 2025
Start My Free Assessment →No account required. Takes approximately 8 minutes.
0%
of all registered Nigerian businesses are SMEs, yet most have no formal NDPA compliance structure in place.
₦0M
in fines issued by the Nigeria Data Protection Commission in 2025 for data protection violations.
0
organisations received NDPC compliance notices in a single month in 2025.
Background
What is the NDPA 2023?
The Nigeria Data Protection Act 2023 is Nigeria's first comprehensive data protection law. It governs how organisations collect, process, store, and share the personal data of individuals in Nigeria. It applies to every business that handles personal data, regardless of size, including the small and medium enterprises that account for the vast majority of the Nigerian economy.
The Nigeria Data Protection Commission (NDPC) is the regulatory and enforcement body. Since 2024 the NDPC has moved from awareness campaigns into active enforcement, issuing fines and compliance notices to organisations across sectors. SMEs are now a clear target.
Five Core Obligations
- 1Appoint a Data Protection Officer where required by NDPC guidelines
- 2Obtain lawful basis for all personal data processing
- 3Notify affected individuals of data breaches within 72 hours
- 4File an annual Compliance Audit Return (CAR) with the NDPC
- 5Conduct a Data Protection Impact Assessment before high-risk processing
Why We Built This
A free compliance tool built for Nigerian SMEs
A free compliance tool built specifically for Nigerian SMEs.
Most Nigerian SMEs know data protection compliance is required but have no way to assess where they actually stand. Hiring a consultant costs hundreds of thousands of naira. Interpreting the Act without legal training is difficult. This system was built to change that.
The assessment covers all 8 domains the NDPC uses during enforcement. Every submission is automatically scored and generates a personalised report with specific actions referenced to NDPA 2023 clauses. It is free, anonymous, and takes under 10 minutes.
How It Works
From form to report in under 10 minutes
01
Fill the Assessment
32 questions across 8 compliance domains, mapped directly to the NDPA 2023. No account or login required. Takes approximately 8 minutes.
02
Automatic Scoring
Your responses are scored in real time across all eight domains. The system calculates your overall compliance score and flags your weakest areas immediately.
03
Receive Your Report
A personalised compliance report arrives in your inbox. It includes your overall score, a full domain breakdown, and a numbered list of remediation actions referenced to specific NDPA 2023 clauses.
The 8 Domains
What the assessment measures
Every question in the assessment maps directly to one of the eight compliance domains the NDPC uses during enforcement reviews.
D2
Lawful Basis & Consent
Legal basis for collecting and using personal data and consent records.
D3
Privacy Notices
Publicly accessible privacy notices covering data types, purposes, and data subject rights.
D4
Data Subject Rights
Processes for handling access, correction, erasure, and restriction requests.
D5
Data Protection Officer
DPO appointment or designated internal data protection lead.
D6
Data Security Measures
Encryption, access controls, staff training, DPIA, and data retention policies.
D7
Breach Management
Incident detection, 72-hour NDPC notification, and breach documentation.
D8
Compliance Audit Returns
CAR filing, DPCO engagement, and internal audit records.
What You Receive
A real compliance report, in your inbox
Every submission automatically generates a personalised NDPA 2023 Compliance Readiness Report. It includes your overall readiness score out of 100, a breakdown across all eight compliance domains, and a prioritised list of remediation actions each referenced to the relevant NDPA 2023 clause. The report is delivered directly to the email address you provide in the form.
Sample report
From: NDPA Assessment <noreply@myndpascore.com.ng>
15 June 2026
Subject: Your NDPA 2023 Compliance Readiness Report
59
/ 100
Partial Readiness
Domain Breakdown
D172
Registration & Classification
D258
Lawful Basis & Consent
D345
Privacy Notices
D468
Data Subject Rights
D532
Data Protection Officer
D655
Data Security Measures
D778
Breach Management
D860
Compliance Audit Returns
Top 3 priority actions
- 1Appoint a Data Protection OfficerNDPA §32
- 2Document lawful basis for all processing activitiesNDPA §25
- 3Implement 72-hour breach notification workflowNDPA §40
Generated by NDPA Compliance Assessment
Common Questions
What to know before you start
Who should complete this assessment?
Any owner, director, compliance officer, or IT lead at a Nigerian SME that handles personal data of customers, employees, or partners. You do not need a legal or technical background to complete it.
How long does it take, and what does it cost?
Approximately 8 minutes. There is no cost, no account required, and no payment step at any point. It is completely free.
What happens to my responses?
Your responses are stored securely and used only in anonymised, aggregate form. They are handled in accordance with the NDPA 2023. No individual response is published or attributed to any named organisation.
Will my results be reported to the NDPC?
No. Nothing you submit is shared with the NDPC or any regulatory body. The assessment is an informational tool, not a reporting mechanism.
What do I receive after completing it?
A personalised compliance report delivered to your email. It includes your overall readiness score, a breakdown across all 8 domains, and specific remediation steps with NDPA 2023 clause references.
Why does this ask for my email address?
Your email is used solely to deliver your report. It is not added to any mailing list, not shared with any third party, and not stored beyond what is needed to send your report.
Ready When You Are
Find out where your business stands in 8 minutes.
Free, confidential, and completely anonymous. Your personalised compliance report arrives in your inbox immediately after you submit.
No account required · Takes approximately 8 minutes · Results delivered by email
8 minutes, free
Find out where your business stands.