When the regulator asks for proof, you'll have it.
Data protection is now enforced, not encouraged. We help organisations in Nigeria and Kenya turn the NDPA, the GAID, GDPR and the KDPA into policies people follow, controls that hold, and an annual audit return filed on time by a licensed DPCO.
No obligation. You leave the call knowing your likely NDPC tier, your next deadline and your three biggest gaps.
Licensed to file
Data Protection Compliance Organisation, licensed by the Nigeria Data Protection Commission
Where we work
Nigeria · Kenya
Since 2015
Regulators, banks, courts and utilities trained and advised
Teams we have trained or advised include regulators, banks, courts and utilities
See what changed for them
Central Bank of Nigeria
First Bank
Zenith Bank
Infobip
Tullow Oil
Transmission Company of Nigeria
Africa Prudential
Webb Fontaine
Most clients call us after one of these moments.
None of them mean you've failed. They mean the rules have caught up with how you work. Here is how we take each one off your desk.
“The board asked if we're compliant. Nobody could say yes with confidence.”
We give you a ranked gap report in plain language and a dated plan your board can track, item by item.
“A bank, regulator or EU partner sent us a security questionnaire.”
We help you answer it with evidence, then close the gaps the questionnaire exposed before the next one arrives.
“Our policies still mention the NDPR 2019.”
We rewrite them for the NDPA and the GAID, and check that your teams actually work the way the documents say.
“The audit return deadline always turns into a scramble.”
We audit months ahead, fix issues before you file, then file on the NDPC portal for you as a licensed DPCO.
“Our DPO left, and the knowledge left with them.”
We cover the role as your outsourced DPO while we train and certify your next lead through Johan Academy.
“We had an incident and didn't know who to call first.”
We write and rehearse a 72-hour breach plan with you, so the next incident is handled calmly and on time.
See your fine exposure before the Commission does.
The Commission has already issued individual fines of more than ₦500 million. Enter your annual gross revenue to see the most it could fine your organisation under the NDPA.
A fine is rarely the largest cost. Investigations take management time, remediation orders come with deadlines, and partners ask hard questions once a case is public.
₦10,000,000
The higher of ₦10 million or 2% of annual gross revenue.
An indication from section 48 of the NDPA 2023, not legal advice. Nothing you type here leaves your browser.
The rules changed in 2025. Most programmes didn't.
If your policies were written for the NDPR 2019, they no longer describe what the Commission checks. Four changes matter most.
Last reviewed 9 November 2026
The GAID replaced the NDPR
The NDPC’s General Application and Implementation Directive now sets the detailed rules under the NDPA. Policies written for the NDPR 2019 need a review.
Audit returns are annual
Higher-tier organisations of major importance file a compliance audit return through a licensed DPCO. The 2026 window closed on 30 May. The next is due 31 March 2027.
Enforcement has begun
The Commission has issued individual fines of more than ₦500 million and reported 246 completed investigations by January 2026.
DPOs must keep learning
Verified Data Protection Officers need at least 20 CPD points a year, with 10 from structured training, or risk being marked inactive.
Also moving: Kenya, the EU and the standards your partners ask about.
Ask what applies to youNew transfer guidance
The ODPC’s September 2026 guidance treats cloud hosting outside Kenya as a cross-border transfer. Registrations last 24 months.
GDPR changes not yet law
The Digital Omnibus is still being negotiated. Most high-risk AI Act duties have been pushed back to December 2027.
27001:2013 has expired
Certificates against the 2013 version lapsed on 31 October 2025. The 2022 version is the one to meet.
v4.0.1 fully in force
Future-dated requirements, including MFA into the cardholder data environment, have applied since 31 March 2025.
Most consultants leave a report. We leave a working programme.
A gap report tells you what's wrong. It doesn't fix it. We put the controls in place with your teams, train the people who will run them, and check that they hold before we step back.
We translate. You act.
Every relevant clause of the NDPA, GAID, GDPR or KDPA becomes a named task for a named team. Nobody has to interpret the law alone.
We build with your IT team
Encryption, access control and logging set up alongside your engineers, not handed over in a slide deck.
We know two regulators deeply
We work only in Nigeria and Kenya, so we know what the NDPC and the ODPC look for when they start asking questions.
We stay until it holds
We test what we built, train the people who run it, and stay on call when the rules change again.
Compliance isn't paperwork. It's how you earn the right to hold other people's information.
Regulators in Nigeria and Kenya now expect evidence, not intentions. We build that evidence into how you already work, so it holds up when someone asks, and keeps holding up after we leave.
Pick the rule keeping you up at night.
Each one comes with a deadline, a regulator and a cost of getting it wrong. Here is what getting it right involves, and how we'd handle it with you.
Policies written for the NDPR 2019 no longer describe what the Commission checks.
Since 19 September 2025, the GAID has set the detailed rules under the Nigeria Data Protection Act, and the Commission has made 2026 its enforcement year. We compare what you have with what the GAID now asks for, fix the gaps in order of risk, and give your board a clear answer to the question it keeps asking: are we compliant?
NDPA 2023 · GAID 2025
Fines for organisations of major importance can reach ₦10 million or 2% of annual gross revenue, whichever is higher.
31 March comes round every year. Make it a non-event.
Higher-tier organisations of major importance must file a compliance audit return through a licensed DPCO every year. We are licensed to file it. We audit early, fix what we find before the Commission sees it, then file and follow up, so the deadline never turns into a scramble.
Compliance Audit Return under the GAID
The 2026 window was extended to 30 May 2026. The next return is due 31 March 2027 unless the Commission announces otherwise. Late filing adds 50% to the fee.
In Kenya, a lapsed registration is an offence, not an admin slip.
ODPC registration lasts 24 months, and since September 2026 hosting data on cloud servers outside Kenya counts as a cross-border transfer. We track your renewal, assess every transfer and put the right clauses in place, so growing in Kenya doesn't quietly grow your exposure.
Kenya Data Protection Act 2019
Fines under the Act can reach Ksh5 million or 1% of annual turnover.
Selling to Europe? One unanswered question can stall the contract.
If you handle personal data of people in the EU, the GDPR applies alongside Nigerian or Kenyan law, and EU partners check before they sign. We run one programme that satisfies both, so you answer their due-diligence questionnaire with evidence instead of promises.
General Data Protection Regulation
The EU’s proposed Digital Omnibus changes are still being negotiated. Today’s GDPR rules apply in full.
Answer the security question before the client asks it.
Tender panels and partners increasingly ask for ISO/IEC 27001:2022, and certificates on the 2013 version expired on 31 October 2025. We prepare your systems and your people step by step, so the certification audit confirms what you already do.
ISO/IEC 27001:2022 · ISO 22301 · ISO 9001
Still on a 2013-based certificate? It is no longer valid. Talk to us about moving to 2022.
The DPO role carries legal weight now. So should the training.
The GAID expects organisations of major importance to appoint a qualified DPO, and verified DPOs need 20 CPD points a year to stay active. We prepare your lead to pass, to perform in the role, and to keep their status.
Certified Data Protection Officer
At least 10 of the 20 annual CPD points must come from structured training or certification.
When a partner asks for proof, the deal waits for your answer.
Card payments, health records, EU or US partners: each brings its own standard and its own questionnaire. We implement the framework behind the answer, and test your systems so the evidence stands up.
International standards for security, continuity and quality. We implement ISO/IEC 27001:2022 for information security, ISO 22301 for business continuity and ISO 9001 for quality management. Certificates against the 2013 version expired on 31 October 2025.
Required if you take card payments. Version 4.0.1 is the current standard, and its future-dated requirements became mandatory on 31 March 2025, including multi-factor authentication for all access into the cardholder data environment and controls on payment-page scripts. We help you scope it, close the gaps and prepare for assessment.
The US rule for protected health information. If you work with US healthcare providers or insurers, they will expect you to meet it.
The EU regulation for electronic signatures, authentication and digital identity. Relevant if you sign or verify documents with EU parties.
Independent reports on your controls. SOC 1 covers financial reporting, SOC 2 covers security, availability, processing integrity, confidentiality and privacy, and SOC 3 is the public summary.
The US government security programme for cloud providers that serve federal agencies.
Certification tracks
NDPA · GDPR · ISO · DPO · DPCO
Build the knowledge into your team, not into one person.
A programme only lasts if your people can run it. Johan Academy certifies DPOs, compliance officers and IT security teams, and keeps verified DPOs on track for the 20 CPD points a year the Commission now requires.
What changed for the teams we trained.
The training gave our team practical insight into GDPR and data compliance, and made us better at safeguarding critical information.
We recommend this training. It gave our staff the skills to work through data protection regulations with confidence.
Comprehensive and insightful. It strengthened our understanding of data security measures and how to stay compliant in our operations.
Our employees now apply stronger data protection practices, and security has improved across the organisation.
Relevant and detailed. Our team came away with practical strategies for keeping data private and secure.
The training improved data security at Zenith Bank, with useful insight and good practice for meeting regulatory requirements.
Effective training. Our staff now have the knowledge and tools to deal with data protection issues before they become problems.
The questions leaders ask us first.
Straight answers, so the first call is about your situation rather than our process.
It depends on your size, your obligations and your deadlines, so we agree the scope first and the price second, in writing. The first 30-minute conversation is free and carries no obligation.
We plan around your calendar and work with the systems you already run. Most of the work happens alongside your teams, not instead of their day jobs.
Lawyers interpret the law. We turn it into working controls, trained people and filed returns, and we are licensed by the NDPC to audit and file compliance audit returns. Many of our clients use both.
If you process the personal data of more than 200 people in six months, the NDPC may treat you as an organisation of major importance, with registration and filing duties. A short call tells you which tier you are likely in.
As soon as the scope is agreed. If a filing deadline or an incident is close, tell us on the first call and we will plan the work around it.
Yes. We handle your information to the standard we help clients meet, and we are happy to sign a confidentiality agreement before you share anything sensitive.
Where do we work?
Nigeria and Kenya. Deliberately.
From Abuja, Lagos and London, we work with organisations answerable to the NDPC and Kenya's ODPC, including those that also serve EU customers under the GDPR. Two regulators, known in depth, means fewer surprises for you.
How we workBy scope, not by package.
You see the scope and the price in writing before any work starts. No bundles padded with things you don't need, and no invoice that surprises your finance team.
Get a scoped quote
