Introduction
We live in a digital age where there is undoubtedly an increasing reliance on data. Businesses and organizations, big and small alike, utilise data to understand their customer base, market their products, and establish their footprint in their various market domains. It has become close to impossible to conduct and grow a successful business without the collection and processing of individuals' personal data such as names, email addresses, telephone numbers, residential addresses, and other identifying information.
Furthermore, with the growing use of Artificial Intelligence (AI) in business operations, data collection has today become more prominent than ever, with businesses increasingly relying on data to improve their services, understand consumer behaviour, and make more market-attuned business decisions. In this regard, we can liken data to a sort of “invisible currency” in our digital economy. When properly managed, it drives innovation and creates opportunities for growth; however, just like any currency, mismanagement can have dire consequences such as creating harm, reputational damage, financial loss, and even legal consequences. Consequently, as the value of data continues to grow, so too does the responsibility that comes with handling it.
This responsibility has made the regulation of data, particularly personal data, a growing priority across jurisdictions, with laws and regulatory frameworks establishing standards for how personal data is collected, stored, used and protected. Examples of these are the European Union General Data Protection Regulation (GDPR), Singapore’s Personal Data Protection Act (PDPA), India’s Digital Personal Data Protection Act (DPDPA) and the United States, Health Insurance Portability and Accountability Act (HIPAA). Nigeria is also no exception to this growing emphasis on data protection.
The legal foundation for the protection of data in Nigeria can be traced to the Right to private and family life provided under the Constitution of the Federal Republic of Nigeria (CFRN) 1999 (as amended) as one of the Fundamental Human Rights. Section 37 of the CFRN provides as follows:
“The privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications is hereby guaranteed and protected.”
Now building on this constitutional foundation, the Nigeria Data Protection Act (NDPA) 2023 established a statutory framework for the protection of personal data in Nigeria and also establishes the Nigeria Data Protection Commission (NDPC), responsible for regulating the processing of personal data and promoting the protection of data subjects’ rights and freedoms. The regulatory framework is further complemented by the NDPC’s General Application and Implementation Directive (GAID) 2025, which provides further direction on the implementation of data protection requirements.
The existence of these laws takes the protection of personal data from a matter of moral responsibility to a legal obligation. As the legal maxim “ubi jus ibi remedium” rightly posits, “where there is a right, there is a remedy”. The right to privacy, therefore, is not merely a principle to be acknowledged; it is a right that the law recognises and seeks to protect. For businesses that collect and process personal data, this also means recognising that there are legal responsibilities attached to how the business handles such data, and that a failure to meet these responsibilities has corresponding consequences.
The question then is, how can a business be certain that it is doing what the law requires? How can it identify gaps in its practices and determine whether its data protection measures are actually working?
This is where data audits come in. Data audits provide a business with the opportunity to examine its data processing activities, identify areas of non-compliance and determine what needs to be done to meet its obligations under the law.
Data Protection Compliance Audits: Beyond Policies on Paper
In seeking to fulfil their data protection obligations, a lot of businesses may put various measures in place to guide how personal data is handled. These may include privacy policies, internal data protection procedures, staff training, access controls, data retention arrangements and procedures for responding to personal data breaches.
These measures are important components of a business’s data protection framework. They help establish internal standards, guide employees in handling personal data, and provide a basis for accountability. However, the existence of such policies and procedures does not, in itself, establish that a business organisation is compliant with its data protection obligations.
A policy may be well drafted but poorly implemented; a procedure may exist on paper but not be followed in practice. For instance, a data retention policy may prescribe when information should be deleted, but is that information routinely reviewed and disposed of by the business when it is no longer needed? Employees may have received data protection training, but do they truly understand how to handle personal information in the course of their daily duties?. Is the privacy policy of the business, which explains how it intends to handle personal data, truly the manner in which the business operates?
In essence, beyond the policies in black and white, true regulatory data compliance can only be assessed against the business organisation’s actual data processing activities and this is where the data audit becomes relevant. The data audit provides an opportunity to look beyond the documentary screen to examine how the business actually collects, uses, stores, shares and protects data. It considers not only the policies and procedures the business has adopted, but also whether these policies and procedures are appropriate, effective and reflected in operations.
What Does a Data Audit Involve?
Generally, a data audit involves reviewing an organisation’s existing data protection arrangements, examining how personal data is handled in practice, identifying areas of risk or non-compliance, and determining where improvements are necessary. The scope of the audit exercise largely depends on the nature of the business of the organisation, the types of personal data it processes, and the data protection obligations applicable to it.
The documents reviewed in an audit may include, but are not limited to, the records of data processing activities, privacy policies, procedures for managing personal data breaches, data retention schedules and agreements governing the processing of personal data by third parties. Beyond documentation, the audit may also involve examining the purposes for which information collected and stored is used, where and how it is stored, how responsibility for data protection is assigned, who has access to it, and whether the business organisation collects only the information necessary for its stated purposes. It may also consider the security measures in place, the organisation’s preparedness to respond to data breaches, staff awareness of their responsibilities, and the safeguards adopted when engaging external/ third-party service providers to process the personal data.
Essentially, it is only through the scrutiny of these audit operations that the business can truly understand its weaknesses in this regard and benefit from the opportunity by improving its data management, reducing unnecessary collection or retention of personal data, strengthening decision-making and accountability and overall at the end support greater operational efficiency, as well as, build client confidence and long-term growth.
Understanding the Requirements for Data Audits
Before considering the specific requirements for data audits, it is useful to clarify two terms that will feature significantly i.e data controller and data processor. The NDPA and GAID use these terms to identify the roles played by the different persons and business organisations in the data sphere.
Section 65 of the NDPA defines a “data controller” as an individual, private entity, public commission, agency or other body who, alone or jointly with others, determines the purpose and means of processing personal data. In other words, the data controller determines the reasons for processing personal data and the manner in which that processing is undertaken.
A “data processor”, on the other hand, is an individual, private entity, or any other body who processes personal data on behalf of or at the direction of a data controller or another data processor. These types of entities may include external service providers responsible for services such as cloud storage or IT support, typically activities that involve handling personal data on behalf of another organisation.
The NDPA also recognises a category known as a Data Controller or Data Processor of Major Importance (DCPMI). Under section 65 of the NDPA and Article 8 of the GAID, this classification applies to data controllers and processors that meet the relevant criteria prescribed by the NDPC, including criteria relating to the number of data subjects whose information they process. The GAID further classifies DCPMIs into three categories: Ultra-High Level (UHL), Extra-High Level (EHL) and Ordinary-High Level (OHL).
Compliance Audits and Compliance Audit Returns (CAR)
Article 10 of the GAID 2025 sets out the requirements for conducting data protection compliance audits and filing Compliance Audit Returns (CARs) with the NDPC. While data controllers and data processors are required to conduct periodic audits of their data processing activities, the annual CAR filing requirement is specifically directed at DCPMIs. The periodic audit involves assessing the business’s data processing activities and the risks associated with them, while CAR is the formal filing of the audit in accordance with the applicable rules.
Looking more at the periodic audits, the risk-based approach involves considering the risks associated with the people, processes and technologies involved in processing personal data. Business organisations must develop or adopt appropriate privacy audit controls, identify points of risk and determine the techniques and frequency of audits needed to address those risks. Article 10(5) of the GAID also specifically highlights the vulnerability of personal data accessible through online devices and requires such devices to be audited as frequently as possible.
Now looking at the CAR, the requirements are specifically provided for under the GAID, DCPMIs are statutorily required to file CARs not later than within 15 (fifteen) months of establishment and thereafter annually not later than 31 March each year. Where this deadline requirement is not met, an administrative penalty equivalent to 50% of the stipulated CAR filing fee will follow in consequence. In addition, the filing process often requires the role of a Data Protection Compliance Organisation (DPCO).
DPCOs are organisations licensed by the NDPC to provide data protection compliance services and may assist business organisations with assessing their data protection practices, conducting compliance audits, identifying gaps, and preparing and submitting relevant compliance documentation. Engaging a licensed DPCO can provide access to specialised knowledge of the applicable regulatory requirements and support a structured assessment of an organisation’s compliance position.
Consequences of Non-Compliance
The need to take data protection compliance and data audits seriously is reinforced by the consequences that can follow upon violation. Under section 48 of the NDPA, the NDPC may impose sanctions where a data controller or data processor is found to be in violation of the provisions of the NDPA. Depending on the circumstances, these may include ordering compensation for a data subject who has suffered injury, loss or harm, requiring an account of profits arising from the violation, or imposing a penalty or remedial fee.
For a data controller or processor that is not of major importance, the applicable maximum may be the greater of ₦2 million or 2% of its annual gross revenue in the preceding financial year. For DCPMIs, the maximum penalty or remedial fee may be the greater of ₦10 million or 2% of its annual gross revenue in the preceding financial year. Section 51 of the NDPA also allows a data subject who suffers injury, loss or harm as a result of a violation to seek damages through civil proceedings.
Beyond these statutorily-dictated consequences, non-compliance may also result in damage to a business organisation’s reputation, undermine customer confidence and expose the business to avoidable financial risks. Moreso, for a business that depends on partnerships, external service providers or international markets, weaknesses in data protection practices can create difficulties in establishing and maintaining commercial relationships.
Conclusion
Data audits are an important part of responsible data and corporate governance. A well-conducted audit can help your business organisation improve its handling of personal data, strengthen internal accountability, reduce unnecessary data collection and retention and build greater confidence among customers, employees and business partners. Ultimately, the value of an audit lies in the fact that it is not only a means to evidence or demonstrate compliance; it is also a veritable vehicle for sustainable business development and through which a business can maintain effective data protection practices as its operations evolve.
