In today’s world, ensuring data privacy is paramount for businesses handling personal data. In Nigeria, organisations that wish to assist in enforcing data protection standards must register as a Data Protection Compliance Organisation (DPCO).
This article provides a comprehensive guide on the registration process, the requirements, and costs involved in becoming a DPCO.
What is a Data Protection Compliance Organisation (DPCO)?
A Data Protection Compliance Organisation (DPCO) is an entity accredited by the Nigeria Data Protection Bureau (NDPB) to offer data protection audits, compliance, training, and consultancy services to data processors and controllers.
A DPCO ensures that these organisations comply with Nigeria’s data protection regulations, including the Nigeria Data Protection Regulation (NDPR).
Key Services Provided by DPCOs
DPCOs offer various services to ensure compliance with NDPR, including:
- Data Protection Audits: Ensuring organisations are compliant with the NDPR.
- Compliance Training: Educating staff on data protection best practices.
- Consultancy Services: Offering specialised guidance on data privacy.
- Policy Drafting: Developing comprehensive data privacy policies.
- Data Impact Assessments: Evaluating the risks associated with data processing activities.
Steps for Registering a Data Protection Compliance Organisation (DPCO)
1. Corporate Affairs Commission (CAC) Registration
The first step in registering as a DPCO is incorporating your business with the Corporate Affairs Commission (CAC). This ensures that your organisation is recognised as a legal entity in Nigeria. The cost of registration depends on your share capital.
- Costs:
- ₦100,000 and above for a share capital starting from ₦1 million.
- This fee increases with the amount of share capital.
2. Obtain Professional or Academic Certifications
To qualify as a DPCO, you must provide evidence of certifications that show expertise in data protection and compliance. At least two staff members must hold professional or academic certifications in the field of data protection.
- Recognised Certifications:
- Certified Information Systems Auditor (CISA)
- Certified Information Privacy Professional (CIPP)
- Data Protection Officer (DPO) certifications
3. Prepare Required Documentation
To obtain a DPCO license, you need to gather several documents:
- Evidence of CAC Registration: Proof of your company’s incorporation.
- Tax Clearance Certificate: Proof of tax clearance from the Federal Inland Revenue Service (FIRS). The cost will depend on your organisation’s financial records.
- Qualifications of Key Staff Members: At least two professionals within the organisation should have certifications in data protection.
- Valid IDs of Two Directors: Government-issued IDs (such as passports or driver’s licenses) of two directors must be submitted.
- Website Registration on a .ng Domain: Your website must be registered under the .ng domain to prove local presence.
- Proof of Payment of Licensing Fee to NDPB: Evidence of payment of the required DPCO licensing fee, which is ₦2,000,000.
4. Submit Application to NDPB
Once all required documents are prepared, you can submit your application to the Nigeria Data Protection Bureau (NDPB). The NDPB will review your submission and assess whether your organisation meets the necessary requirements to offer DPCO services.
5. Approval and Issuance of License
Upon a successful review, the NDPB will issue a DPCO license. This license authorises your organisation to conduct audits, provide consultancy services, and ensure compliance with data protection laws in Nigeria.
Table: Breakdown of DPCO Registration Requirements and Costs
| Requirement | Details | Estimated Cost (₦) |
|---|---|---|
| CAC Registration | Based on share capital (₦1 million+) | ₦100,000+ |
| Professional Certifications | CISA, CIPP, or DPO qualifications | ₦500,000+ |
| Tax Clearance Certificate | Depends on financial records | Varies |
| Qualifications of Two Key Staff | Academic/professional data protection certifications | Varies |
| Valid IDs of Two Directors | Passport, Driver’s License, National ID | – |
| Website Registration (.ng Domain) | Registration under Nigeria’s .ng domain | ₦50,000 – ₦150,000 |
| Licensing Fee to NDPB | Paid to the Nigeria Data Protection Bureau | ₦2,000,000 |
