Every DPCO runs the same core job each year: take a client from "not started" to a Compliance Audit Return that's ready to file.
DPO Copilot was built around that one workflow. This post walks through it step by step, the way a DPCO team actually uses it, from adding a client to getting their sign-off.
If you want the bigger picture first, read our CAR Season Survival Guide. This post is the hands-on version: what happens on screen, who does what, and what stays in your team's hands.
Step 1: Add the client
Every client gets its own space in your firm's workspace, with its records, evidence and audit status in one place.
You don't have to start from zero. If you already track clients in spreadsheets, import your existing records from Excel or CSV and pick up where you left off.
Step 2: Assign the team
The lead consultant assigns each client to the right people. DPO Copilot has three roles:
- Firm Admin manages the workspace, users and settings.
- Lead Consultant oversees clients and reviews the work.
- Associate works on the clients assigned to them, and only sees those clients.
Everyone knows whose client is whose, and nobody sees more than they need to.
Step 3: Collect evidence through the client portal
Instead of chasing documents on email and WhatsApp, you invite the client into their own portal. There, they can see the audit's progress and upload evidence directly.
Evidence is sorted by the five GAID audit areas: governance, data security, accountability and risk, cross-border transfers, and third-party processors. You can see at a glance what's in and what's still missing.
Step 4: Run the gap analysis
As evidence comes in, the CAR readiness checklist shows where each client stands across the five areas.
The AI copilot then drafts gap findings against the NDPA 2023, so your consultant isn't writing the same findings from scratch for every client. Your consultant reads, edits and approves every finding before it goes anywhere.
Step 5: Get the client's sign-off
When the report is ready, the client reviews it in their portal and formally approves it. You have a clear record of who approved what, and when.
With sign-off done, your firm files the CAR with NDPC as usual.
What stays with your team
DPO Copilot doesn't run the audit for you. Your consultants still decide what counts as good evidence, which gaps matter and what goes in the final report.
The AI copilot sits on top of the workflow and handles the repetitive parts: drafting documents, drafting gap findings and answering regulatory questions. Every draft is a starting point for your consultant, never the final word.
That's the line we drew on purpose. Clients pay a DPCO for professional judgment. The software should protect that time, not replace it.
How your clients' data is kept safe
A compliance tool that's careless with data would be a bad joke. These are the choices we made:
- A dedicated server for each firm. Your clients' data sits on your firm's own server, not mixed with other firms' data.
- Data stays in Nigeria. Client data, including what the AI copilot processes, stays in the country.
- Access by role. Associates only see the clients assigned to them, and clients only see their own portal.
- A record of sign-off. Client approvals are logged, so you can show who approved each report and when.
Beyond the CAR
The audit is the big annual job, but compliance work runs all year. DPO Copilot covers that too:
- DSAR tracker. Log each data subject access request and track it against a 30-day deadline by default, so nothing slips.
- Regulatory library. A library of NDPA and NDPC guidance, kept up to date by the DPO Copilot team as new guidance comes out.
- Regulatory Q&A. Ask the AI copilot a question about the NDPA and get an answer grounded in that library.
FAQs
Do we have to re-enter our existing client records?
No. You can import your existing records from Excel or CSV when you set up.
Does the AI write the final audit report?
No. It drafts documents and gap findings. Your consultants review, edit and approve everything before a client sees it.
Where is our clients' data stored?
On a dedicated server for your firm, in Nigeria. That includes data processed by the AI copilot.
Can our clients see each other's information?
No. Each client only sees their own portal.
**Which laws does DPO