DATA PROTECTION COMPLIANCE SERVICES (DPCO)

Pavestones is a full-service practice that provides legal services to companies in various sectors including technology and financial services.

We are licensed by the National Information Technology Development Agency (NITDA) as one of the few Data Protection Compliance Organisations (DPCO) in Nigeria. Our license enables us to conduct data protection audits and consultancy services; trainings, and generally assist companies in complying with the Nigeria Data Protection Regulation

WHY DO YOU NEED A DPCO ?

The Nigeria Data Protection Regulation, 2019 (the “Regulation”) issued by NITDA, requires companies and businesses that collect and process personal data of Nigerians (whether resident in Nigeria or not) to engage the services of DPCO to conduct audits, in line with the provisions of the Regulation. Companies that fail to comply are at risk of a penalty of up to 2% of their annual gross revenue or 10 million naira (whichever is greater) issued by NITDA, in addition to any criminal or civil liability.

WHICH COMPANIES ARE REGULATED ?

Companies (whether located in Nigeria or not) that collect or process the personal information of Nigerians (such as names, email addresses, physical addresses, telephone number, bank details or any personal information) whether in Nigeria or not.

WHEN YOU SHOULD ENGAGE A DPCO ?

If you have data of up to 1000 Nigerians, you are mandated by law to engage the services of a DPCO for the purpose of auditing your data practices.

WHY SHOULD YOU COMPLY ?

By engaging a DPCO :

You are in good standing with NITDA as it is evidence to NITDA that your company is willing to comply with the provisions of the Regulations;
It improves customer experience with your product or service, as customers are confident of your company’s data management practice;
It ensures your staff are properly trained on data protection practices and reduces the risk of a data breach by your company;
It helps to identify the issues and defects in your data privacy practice and provide solutions to rectify it.

We understand that data plays a pivotal role in helping companies understand the needs of the market. It is, therefore, important to us to support you in handling data with care and avoiding regulatory sanctions. Our team is highly skilled in data protection audit and compliance services, and we work with information technology and cyber security experts to ensure recommendations are seamlessly implemented.

WHAT SERVICES DO WE OFFER

Data Protection Compliance
Our data protection compliance service (DPCO Services) is designed to help organisations implement the requirements of the Regulations. We have developed a framework that organisations adopt to ensure their compliance with, not just the NDPR but with similar Data protection regulations of other countries.
Audit
In carrying out our audit, we assess the data protection level of organizations and subsequently make recommendations to ensure the organizations meet and exceed the requirements of the NDPR.

We also support organisations in implementing the recommendations including by providing guidance on the preparation of the requisite data protection documents and polices to guide the organisation.
Training
We train key staff in organisations that have engaged our services including Data Protection Officers, Compliance Officers, IT Security Officers, Risk Manager amongst others. Our training is carefully formulated to enable your organisation implement a suitable compliance framework necessary for the protection of personal data.
Data Protection Officer Secondment/Support Services
We are also able to provide services as internal data protection officers (DPO Services) within an organisation. In this case, a dedicated member of our team will be in charge of data management, conducting periodic training of staff, conducting regular data impact assessments and audits of each department in compliance with the NDPR, maintaining records of all data processing activities, amongst others.