AUTOMATED SAAS Tired of static compliance spreadsheets? Automate NDPA 2023 with TrustGuard NG Explore Level 5 Autonomous SaaS →

CAR Deadline: March 15 | 72h Breach Watchdog

NDPA 2023 STATUTORY ASSESSMENT

Enterprise Compliance Audit Wizard

Answer the following 36 statutory questions across five NDPA 2023 pillars to calculate your compliance health grade, identify legal gaps, and generate your audit-ready action roadmap.

Autosaved locally

Pillar 1 of 5 0% Completed

Organization Profile

Please provide your corporate details to customize your executive report and audit recommendations.

Organization / Company Name *

Contact Email (for Report Delivery) *

Industry Sector

Estimated Data Subjects Processed

Enterprise Compliance Audit Wizard

Organization Profile

Pillar 1: Lawful Bases & Principles

Do you have special protections for children's personal data?

Do you obtain parental consent before processing children's personal data?

Is consent freely given, specific, informed, and unambiguous?

Do you have a mechanism to record and manage consent withdrawals?

Does your organization regularly revise contracts with employees, clients, customers, and vendors to include data protection clauses?

Does your organization have a documented lawful basis for processing personal data?

Do you obtain explicit consent before processing sensitive personal data?

Do you have a documented data retention policy?

Do you securely dispose of personal data when it is no longer needed?

Pillar 2: Data Subject Rights (DSAR)

Do you have procedures to handle requests from data subjects exercising their rights?

Do you provide individuals with access to their personal data upon request?

Do you allow individuals to rectify or erase their personal data when requested?

Do you provide data portability to individuals upon request?

Pillar 3: Security & 72h Breach Reporting

Do you have procedures to detect, report, and investigate personal data breaches?

Do you notify the relevant authority of data breaches within 72 hours of becoming aware of them?

Do you implement appropriate technical and organizational security measures?

Do you regularly test and evaluate the effectiveness of your security measures?

Do you incorporate encryption, anonymization, and pseudonymization into your systems?

Does your organization follow an information security standard?

Pillar 4: Governance & DPO Mandates

Have you appointed a Data Protection Officer (DPO)?

Does your DPO have the necessary expertise, resources, and authority to fulfill their role?

Does your organization ensure that C-Suite Management and the Board of Directors are aware of NDPR compliance requirements?

Does your organization provide regular updates to C-Suite Management and the Board of Directors on NDPR compliance status?

Does your DPO have independence and direct access to C-Suite Management?

Does your DPO carry out regular reviews of internal policies to ensure compliance with data protection regulations?

Does your organization have documented policies for: HR, Information Security, Incident Management, Privacy, Data Breach Management, Data Retention, Disaster Recovery, and DPIA?

Is NDPR risk in terms of potential fines included in your corporate risk register?

Does your DPO ensure regular capacity building for themselves and other personnel to ensure compliance with the NDPR?

Does your organization provide regular data protection training to employees who handle personal data?

Pillar 5: DPIA, Cross-Border & Audit Returns

Do you have procedures to ensure adequate protection when transferring personal data outside Nigeria/EU?

Do you use appropriate safeguards (e.g., Standard Contractual Clauses, Binding Corporate Rules) for international data transfers?

Do you conduct regular audits of your data protection practices?

Do you maintain records of your processing activities?

Does your organization file its Annual Data Protection Compliance Audit Return (CAR) with the NDPC on or before 31 March of the following year?

Do you conduct Data Protection Impact Assessments (DPIAs) for high-risk processing activities?

Do you consult with supervisory authorities before processing that is likely to result in high risk?