According to NDPC, the organisations must submit proof of filing their 2024 musangbos Compliance Audit Returns, provide details of their Data Protection Officer (DPO), present a summary of their technical and organisational data protection measures, and show evidence of registration as a Data Controller or Processor of Major Importance.

National Commissioner of the NDPC, Dr. Vincent Olatunji, said the exercise is aimed at protecting citizens’ digital rights and strengthening trust in Nigeria’s digital economy.

“We are sending a clear message that data protection is not optional — it is a legal duty. Every Nigerian has a right to know that their personal data is being handled responsibly, and organisations must be held accountable,” he said.

The Commission warned that failure to comply within the deadline could lead to enforcement orders, administrative fines, or criminal prosecution.

“Personal data is the new oil in the digital economy, but it must not be exploited carelessly. The NDPC will not hesitate to impose stiff penalties on violators of the Data Protection Act,” Olatunji added.

Digital rights advocates have welcomed the move, describing it as timely. Ngozi Adedeji, a data privacy campaigner, said it would compel organisations to prioritize citizens’ privacy.

“For too long, Nigerians have been vulnerable to data theft and abuse. This compliance drive is a wake-up call for organisations to take privacy seriously,” she said.

The NDPC also disclosed that the list of organisations under review will be published in leading national newspapers from Monday, August 25, 2025.

The Commission said the compliance drive represents a critical step towards building a safer and more trusted digital environment in Nigeria.