Data Protection Compliance Audit Report: Extension of Deadline & Waivers
In the wake of the ongoing Corona Virus ("Covid-19") pandemic which has recently affected Nigeria, and considering the difficulties organisations are already experiencing in adjusting to the new Data Protection landscape in Nigeria, the National Information Technology Development Agency ("NITDA" or "the Agency"), which is the regulator of the Nigerian Data Protection space, has made a few concessions on some of the obligations on organisations within its regulatory jurisdiction.
The Agency had issued the Nigerian Data Protection Regulation in January 2019, which imposes obligations on all companies or organisations that process personal data to conduct a mandatory annual audit of their privacy and data protection practices. The Regulation required organisations that process personal data of more than 1000 data subjects to file an Initial Data Audit Report by July 25, 2019 (subsequently extended to October 25, 2019) and annual reports by March 15 each subsequent year. As such, qualifying organisations are expected to have filed an Initial Data Audit Report by October 25, 2019, and Annual Data Audit Report by March 15, 2020.
New Developments
- In a communication issued on March 30, it was made know that the Director-General
has granted an extension of time to file audit reports to all organisations that have
filed/or would subsequently file an application requesting such extension. The extended
deadline is May 15, 2020. Accordingly, all organisations who are yet to file their data
audit report have till Friday, May 15, 2020, to do so. - In an earlier communication, the Agency confirmed that all organisations that filed an Initial Data Audit Report (for 2019) would enjoy an exemption from the requirement to file an Annual Data Audit Report for 2020. Perhaps, given the short period between the two filing periods (for October 2019 and March 2020), the Agency had announced that for organisations who file an Initial Data Audit Reports before March 15, 2020, the requirement to file a Data Audit Report for 2020 is waived.