Know where you fall short of the NDPA 2023, and what to fix first.
A gap assessment against the Nigeria Data Protection Act 2023 and ISO/IEC 27001:2022 for small and growing organisations. You get a gap analysis, a risk register and a 90-day remediation roadmap, in plain language.
Report delivered within 2 working days of receiving your completed questionnaire and payment.
No documented personal data breach procedure
- NDPA 2023
- Section 40
- ISO/IEC 27001
- A.5.24
- Priority
- Quick win (days 1–30)
Write and test a breach response procedure, name who decides whether to notify the NDPC within 72 hours, and keep a breach log.
Likelihood × Impact. Not drawn from any client report.
What you receive
- Gap analysis
- Your most important gaps against the NDPA 2023 and ISO/IEC 27001:2022, each with its legal or standard reference, why it matters for your organisation, and the specific action to take.
- Risk register
- Information security and data protection risks scored by likelihood and impact, with a recommended control for each.
- 90-day remediation roadmap
- The work sequenced into three 30-day phases, so you fix the highest risks first and build from there.
- A 30-minute walkthrough call
- We go through the report together and agree what you will do first.
How it works
- Agree and pay. You sign a short engagement letter and pay the fee before work begins.
- Answer the questionnaire. 36 plain-language questions about your organisation, how you handle personal data and how you protect your information. No personal data about individuals is needed.
- Receive your report. Within 2 working days, as a password-protected PDF, with the password sent separately.
- Walk through it. A 30-minute call to explain the findings and agree your first steps.
Fee
₦120,000
Per assessment, for small organisations. Larger organisations are quoted on request.
Founding rate: ₦60,000 for the first three organisations, in exchange for written permission to name you as a reference.
Payment by bank transfer to Masdar Cyber Ltd’s corporate account.
What this is, and what it is not
The report is a pre-audit readiness evaluation. It shows where you stand and what to do next.
- It is not an audit, a certification or a statement that you are compliant.
- It is not legal advice.
- It does not replace a compliance audit by a licensed Data Protection Compliance Organisation. Some organisations must file their annual Compliance Audit Returns with the NDPC through one.
The analysis is AI-assisted. Every report is checked, corrected where needed and approved by a consultant under a written review procedure before it reaches you. Your answers are kept confidential and used only for your assessment.
After the assessment
If you want help acting on the roadmap, we can prepare the documents it calls for, such as a privacy notice, a record of processing activities, data protection and information security policies, and procedures. This work is scoped and quoted separately once your report is delivered.
Who you work with
Quadri Durodola is the founder and principal consultant of Masdar Cyber Ltd, based in Ibadan. His work is in data protection and information security governance: NDPA gap assessments, records of processing activities, risk registers and remediation planning.
He has carried out an NDPA gap assessment of a Nigerian community savings platform, provided pro bono NDPA compliance support to a cooperative society, and mentors GRC professionals across Africa with ICDFA SheSec Africa.
- ISO/IEC 42001:2023 Lead ImplementerInternational Cybersecurity and Digital Forensics Academy (ICDFA), Certificate of Training, issued 5 October 2026
- ForHumanity IAAIS LicenceIndependent audit criteria for AI systems
- PrivacyOps Academy CertifiedSecuriti
- IBM Cybersecurity Analyst Professional CertificateIBM / Coursera, December 2023
Start with a conversation
Tell us what your organisation does and what prompted the question. We will tell you honestly whether an assessment is the right next step.