← Back to Insights
October 3, 2026 · Updated October 3, 2026

Am I a Data Controller of Major Importance? UHL, EHL and OHL Explained

By Oluwafemi Ofobutu · Founder & CEO, StackWeaver · 5 min read

Sourced from primary regulatory documents where available. How we research and correct our guides.

Short answer: The NDPC classifies data controllers and processors of major importance into three tiers by how many people’s data they process in six months: Ultra-High Level (over 5,000), Extra-High Level (over 1,000) and Ordinary-High Level (over 200). Each tier registers with the NDPC and pays an annual fee; the two higher tiers also file a yearly Compliance Audit Return through a licensed DPCO 12.

Last updated 3 October 2026. Not legal advice.

TierData subjects in 6 monthsTypical examplesAnnual registration fee (2024 guidance)
Ultra-High Level (UHL)over 5,000Commercial banks, telecoms, insurers, large platforms, energy companies₦250,000
Extra-High Level (EHL)over 1,000Microfinance and mortgage banks, universities, government agencies, tertiary hospitals₦100,000
Ordinary-High Level (OHL)over 200SMEs, schools, primary health centres, contractors₦10,000

Quick self-check for fintechs

  1. Count unique customers (and staff) whose personal data you processed in any six-month window.
  2. Over 5,000 → treat yourself as UHL unless counsel advises otherwise. Most active fintechs cross this quickly.
  3. Register on the NDPC portal, renew yearly, and plan your CAR with a licensed DPCO.

StackWeaver helps you keep the records the NDPC and your DPCO ask for as reviewed, verifiable evidence. See NDPA compliance.

Sources

Footnotes

  1. Andersen Nigeria, summary of the NDPC Guidance Notice “Registration of Data Controllers and Data Processors of Major Importance” (14 February 2024). https://ng.andersen.com/ndpc-issues-guidance-notice-on-the-registration-of-data-controllers-and-processors-of-major-importance/ ↩

  2. Templars (via Mondaq), 28 January 2026. https://www.mondaq.com/nigeria/data-protection/1736914/data-protection-compliance-in-nigeria-audit-return-obligations-for-2026 ↩