NDPA 2023 and ISO 27001: where they meet
ISO/IEC 27001 certification is not NDPA compliance, but a working ISMS produces much of the security evidence the Act and the NDPC's compliance audit returns ask about. Here is where the two overlap and how to audit for both.
Nigerian organisations that hold an ISO/IEC 27001 certificate often get the same question from their board or their data protection officer: does this cover the Nigeria Data Protection Act? The short answer is that it covers some of it, and it can produce good evidence for that part. This guide sets out where the two meet, where they do not, and how to use your internal audit programme to test both.
This guide is general information, not legal advice. For decisions about your obligations under the Act, take advice from a lawyer or a licensed Data Protection Compliance Organisation.
What the NDPA 2023 requires
The Nigeria Data Protection Act 2023 (Act No. 37 of 2023) established the Nigeria Data Protection Commission (NDPC). It applies to controllers and processors domiciled, resident or operating in Nigeria, to processing that happens in Nigeria, and to controllers outside Nigeria that process personal data of data subjects in Nigeria. At a high level it requires:
- Principles (s.24). Processing must be fair, lawful and transparent, limited to specified purposes, minimised, accurate, kept no longer than necessary, and secure. Section 24 also requires appropriate technical and organisational measures for confidentiality, integrity and availability, and makes controllers and processors demonstrate accountability.
- Lawful basis (s.25) and transparency (s.27) about who you are, why you process, who receives the data, how long you keep it and what rights people have.
- Data privacy impact assessments (s.28) before processing likely to result in high risk.
- Processor obligations (s.29), including a written agreement and appropriate security measures when a controller engages a processor.
- Data Protection Officers (s.32) for data controllers of major importance.
- Data subject rights (ss.34–38), such as access, rectification, erasure and objection.
- Security, integrity and confidentiality (s.39). Measures proportionate to the data, the harm and the processing, which may include pseudonymisation, encryption, resilience, timely restoration after an incident, periodic risk assessments, and regular testing and updating of measures.
- Breach notification (s.40). Processors notify the controller; controllers notify the Commission within 72 hours where a breach is likely to result in a risk to individuals, tell affected people directly where the risk is high, and keep a record of all breaches.
- Cross-border transfers (ss.41–43), with a recorded basis for each transfer.
- Registration (s.44) for data controllers and processors of major importance, including a general description of risks, safeguards and security measures.
The GAID 2025 and compliance audit returns
The NDPC issued the General Application and Implementation Directive (GAID) on 20 March 2025, and it became operational on 19 September 2025. It supersedes the Nigeria Data Protection Regulation 2019 and gives detail on matters such as impact assessments and the role of data protection officers.
The GAID’s compliance audit return (CAR) is the part most likely to touch your audit programme. As summarised by Templars in January 2026:
- Data controllers and processors of major importance in the Ultra-High Level and Extra-High Level tiers file a CAR each year, on or before 31 March, covering the previous year.
- The Ultra-High Level tier includes commercial banks, telecoms companies, insurers, multinationals, oil and gas companies and fintechs, among others, and any organisation processing personal data of more than 5,000 data subjects within six months.
- Returns are filed through a licensed Data Protection Compliance Organisation on the NDPC’s portal.
- The assessment areas include governance, data security controls and standards, accountability and risk evaluation, cross-border transfer, and third-party data processors.
- Late filing attracts an additional fee, and failure to file can attract a fine of up to 2% of the previous year’s annual gross revenue or ₦10,000,000, whichever is greater.
Two of those assessment areas, data security controls and third-party processors, are where an ISMS already generates evidence.
What ISO 27001 does and does not cover
ISO/IEC 27001:2022 specifies an information security management system: a risk assessment, a risk treatment plan, a statement of applicability covering the 93 Annex A controls, internal audits, management review and corrective action. Its subject is information security risk to the organisation, which overlaps with, but is not the same as, risk to data subjects.
What an ISMS can help evidence:
- That security measures are chosen through a documented risk assessment, which matches the proportionality factors in s.39(1).
- That measures are tested and improved, through internal audits, monitoring and corrective action.
- That incidents are detected, managed and recorded.
- That suppliers handling information are assessed and bound by agreements.
What it does not address on its own: lawful bases, privacy notices, data subject rights, retention justified by purpose, impact assessments focused on data subjects, cross-border transfer bases, DPO designation, NDPC registration and CAR filing. A certificate also says nothing about whether personal data processing sits inside the certified scope. Check the scope statement before relying on it.
Mapping NDPA themes to ISMS evidence
The table pairs NDPA themes with ISO/IEC 27001:2022 clauses and Annex A controls whose records can help evidence them. It is a starting point for audit criteria, not a compliance map.
| NDPA theme | ISO/IEC 27001:2022 element | Records that can help evidence it |
|---|---|---|
| Security of processing and risk assessment (s.24(1)(f), s.39(1), s.39(2)(e)) | Clauses 6.1.2 and 6.1.3; statement of applicability | Risk assessment that names personal data assets; treatment plan; SoA justifications |
| Encryption and pseudonymisation (s.39(2)(a)–(b)) | 8.24 use of cryptography; 8.11 data masking | Cryptography standard; key management records; masking in test environments |
| Resilience and restoration (s.39(2)(c)–(d)) | 8.13 information backup; 5.29 and 5.30 continuity controls | Restore test results; continuity exercise reports |
| Testing and updating measures (s.39(2)(f)–(g)) | Clause 9.2 internal audit; 8.8 technical vulnerabilities; clause 10.2 | Audit reports; vulnerability scan follow-up; closed corrective actions |
| Breach notification and records (s.40) | 5.24 to 5.28 incident management | Incident log with timestamps for awareness and notification; lessons learned |
| Processors and sub-processors (s.29) | 5.19 to 5.23 supplier controls | Supplier assessments; contracts with security clauses; supplier audit records |
| Legal obligations and privacy (s.24 accountability) | 5.31 legal requirements; 5.34 privacy and protection of PII | Register of applicable law including the NDPA and GAID; privacy policy |
| Retention and deletion (s.24(1)(d)) | 8.10 information deletion; 5.33 protection of records | Retention schedule; deletion logs |
| Staff awareness | 6.3 awareness, education and training | Training records covering data protection |
Auditing for both in one programme
Most organisations that already run ISO/IEC 27001 internal audits can extend them rather than build a separate data protection audit. Practical ways to do it:
- Add the NDPA and GAID to the audit criteria for selected audits, citing sections, so a gap can be written against a specific requirement.
- Use risk to set frequency. Apply risk-based thinking: processes that handle large volumes of customer data, such as onboarding, payments or HR, get audited more often than low-risk areas. The guide on a risk-based audit programme shows one way to weight this.
- Time the cycle to the CAR. If you file by 31 March, schedule the data protection audits in the last quarter of the previous year so corrective actions have time to close before your DPCO assembles the return.
- Audit processors as well as your own processes. Section 29 and the CAR both look at third parties. A supplier audit or a documented questionnaire review gives you something to show.
- Feed results into management review. NDPA findings, breach records and CAR outcomes are natural inputs alongside ISMS performance.
In Orisynx, audits can be started against ISO/IEC 27001:2022 or as a custom audit from your own template, so NDPA checks can sit in the same programme as ISMS audits.
Internal audit ideas to start with
These audits each test a specific NDPA duty using ISMS records as audit evidence:
- Breach drill trace. Pick two recent security incidents. Check when the organisation became aware, whether anyone assessed the risk to individuals, and whether the 72-hour decision is recorded either way.
- Processor contract sample. Sample five suppliers that process personal data. Look for a written agreement, security obligations, and notification duties that would let you meet s.40.
- Restore test. Ask for the latest backup restore test for a system holding customer data, and check that failures led to action.
- Retention check. Compare the retention schedule with what is actually held in one system, such as old applicant records in the HR platform.
- Encryption in practice. Check whether laptops and removable media used by staff handling personal data are encrypted, against the cryptography standard.
- Access review. Sample leavers and role changes in a system holding personal data, and check access was removed or changed on time.
Each finding should name the NDPA section and the ISMS control together, so the process owner sees both the security gap and the legal exposure. In Orisynx, each checklist answer is recorded as “in order” or as an “exception”, and findings carry corrective actions with an owner who accepts or disputes them.