CAR season does not break DPCOs because the work is hard. It breaks them because the work is scattered.
If you run a Data Protection Compliance Organisation (DPCO) in Nigeria, you know the feeling. Ten, twenty or fifty clients. One deadline. Evidence sitting in email threads, WhatsApp chats and someone's desktop folder. Every client thinks they are your only client.
This guide is for DPCO teams who want to get through the next Compliance Audit Return (CAR) season with less panic and better audits. It covers what the CAR requires, why multi-client audits fall apart, and a simple playbook you can start using now.
A quick refresher on the CAR
The CAR is an annual filing that data controllers and processors of major importance submit to the Nigeria Data Protection Commission (NDPC), through a licensed DPCO. It rests on the NDPA 2023 and the General Application and Implementation Directive (GAID) 2025.
| What | Detail |
|---|---|
| Who files | Organisations in the Ultra-High Level (UHL) and Extra-High Level (EHL) categories |
| UHL examples | Commercial banks, telcos, insurers, fintechs, payment gateways, oil and gas, or anyone processing data of 5,000+ people in 6 months |
| EHL examples | Government MDAs, microfinance and mortgage banks, higher institutions, secondary and tertiary hospitals, or anyone processing data of 1,000 to 5,000 people in 6 months |
| Template | Schedule 2 of the GAID |
| Who submits | A licensed DPCO, on the NDPC compliance portal, on the client's behalf |
| Usual deadline | 31 March every year, covering the previous year |
| Late filing | Up to 50% extra on the filing fee |
| Not filing | A fine of up to 2% of prior-year annual gross revenue or ₦10 million, whichever is greater |
For the 2025 audit year, NDPC extended the deadline from 31 March to 30 May 2026 (Pavestones Legal). Don't plan around extensions. Plan around 31 March.
Sources: NDP Act General Application and Implementation Directive (GAID) 2025, Nigeria Data Protection Act 2023 and NDPC FAQs
Why multi-client audits fall apart
Most DPCOs don't fail CAR season on knowledge. They fail on coordination. The same problems show up in almost every firm:
- Evidence lives everywhere. Policies come by email, screenshots by WhatsApp, the ROPA in a shared drive nobody updated. Finding one document can take a day.
- Spreadsheets multiply. One tracker per client, one per consultant, one "final final" version. Nobody knows which is current.
- Ownership is fuzzy. Associates and leads both think the other person chased the client. The gap shows up two weeks before deadline.
- Clients go quiet. The DPO you need is on leave. The IT head never sends the security policy. Every delay lands on your team.
- Every report starts from zero. The same gap findings get rewritten by hand for each client, so quality depends on who is tired that week.
None of this needs more staff. It needs one system everyone works from.
A CAR season playbook for DPCO teams
Start in Q4, not in March. Here's a simple run you can adapt to your firm:
- October to November: map your book. List every client, their UHL or EHL category, their lead consultant and their client-side contact. Flag anyone newly in scope.
- November: send one evidence request per client. Same structure for everyone, organised by audit area, with a clear due date. No ad-hoc WhatsApp asks.
- December to January: collect and review. Track what's in, what's missing and what's weak. Chase weekly, not at the end.
- January to February: run gap analysis and draft reports. Use a standard findings library so reports are consistent across consultants.
- February: client sign-off. Walk each client through findings and get formal approval before anything is filed.
- By mid-March: file. Leave buffer for portal issues, payment delays and last-minute corrections.
- After filing: carry forward. Keep each client's remediation plan live, so next year's audit starts from where this one ended.
The point is rhythm. When every client moves through the same stages, your team always knows who is stuck and why.
Five areas to check for every client
The GAID audit covers five assessment areas. Use them as your evidence checklist for every client:
| Area | What to look for |
|---|---|
| Governance (people and process) | DPO appointed, privacy policy, staff training records, ROPA up to date |
| Data security controls | Access controls, encryption, incident response plan, breach log |
| Accountability and risk | DPIAs for high-risk processing, risk register, lawful basis documented |
| Cross-border transfers | Where data goes, adequacy or safeguards, transfer records |
| Third-party processors | Processor list, signed data processing agreements, vendor due diligence |
If a client can't show evidence for an area, that's a finding. Write it down early, not on filing day.
Where DPO Copilot fits
DPO Copilot is built for DPCO firms that manage many clients at once. It turns the playbook above into one workspace your whole team works from.
- One home for every client. Each client has its own records, evidence and audit status. Import existing records from Excel or CSV, so you don't start from scratch.
- Clear roles. Firm Admins, Lead Consultants and Associates each see what they need. Associates only see the clients assigned to them.
- A built-in CAR readiness checklist. Organised around the same five GAID areas, so you can see at a glance which client is ready and which is stuck.
- A client portal. Clients view progress, upload evidence and approve reports in one place. No more chasing documents on WhatsApp.
- An AI copilot that sits on your workflows. It drafts documents, runs gap analysis against the NDPA and answers regulatory questions, so your consultants spend time on judgment, not typing.
- Data that stays in Nigeria. Each firm gets its own dedicated server for its clients' data.
Your team still runs the audit. DPO Copilot keeps it organised.
FAQs on the NDPC Compliance Audit Return
What is the NDPC Compliance Audit Return?
An annual filing that data controllers and processors of major importance submit to the Nigeria Data Protection Commission under the NDPA 2023 and GAID 2025.
When is the CAR deadline?
31 March every year, covering the previous year. For the 2025 audit year, NDPC extended it to 30 May 2026.
Who must file a Compliance Audit Return?
Organisations classed as Ultra-High Level or Extra-High Level under the GAID, such as banks, telcos, fintechs, MDAs, hospitals and higher institutions.
Can an organisation file the CAR by itself?
No. A licensed Data Protection Compliance Organisation files it on the NDPC compliance portal on the organisation's behalf.
What happens if you don't file?
Late filing can add up to 50% to the filing fee. Not filing can attract a fine of up to 2% of prior-year annual gross revenue or ₦10 million, whichever is greater.
Start this CAR season ahead
The firms that file calmly in March are the ones that got organised in October. Map your clients, standardise your evidence requests and give your team one place to work.
Want to see how DPO Copilot handles a full CAR cycle? Book a demo at www.dpocopilot.ng or email info@dpocopilot.ng.
DPO Copilot is powered by Bitechnologies.