Where the NDPR and this Framework do not provide for a data protection principle or process, the African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention) 2014 and European Union General Data Protection Regulation (EU GDPR) and its judicial interpretations shall be of persuasive effect in Nigeria. ANNEXURE A AUDIT TEMPLATE FOR NDPR COMPLIANCE A. This template is a guideline for Data Controllers and Administrators to show evidence of compliance. The template may be modified in so far as the essence of the reporting is achieved in a concise but comprehensive manner. B. Responses must be evidenced with documentary evidence. False reporting is a criminal offence. The Data Controller and the DPCO shall be jointly liable except otherwise proven. C.NITDA may review the audit questions and communicate such update to DPCOs from time to time No NDPR Provision 1 Question Response Comments Accountability and governance Did you process the personal data of: a. 1.1 Article 4.1(6) and (7) more than 1,000 (one thousand) Data Subjects in the last 6 months; or b. more than 2,000 Data Subjects in the last 12 months? Is your top-management aware of the Nigeria Data 1.2 Article 1.1 and 1.2 Protection Regulation (NDPR) and the potential implication on your organisation? 1.3 Article 2.6 1.4 Article 2.1(d) Have you implemented any information security standard in your organisation before? If YES, specify. Do you have a documented data breach incident management procedure? 30 | P a g e