c) Honesty - DPCOs must state verifiable facts and not conjectures, half-truths or concealed facts. The essence of the audit is not to sanction organisations, but to provide an insight on how the country’s cyber and information management practices can be improved. Any established falsehood in an audit report or communication to NITDA by the DPCO, and which falsehood was known to the DPCO at the time of preparing such report or communication, is a ground for the immediate withdrawal of the DPCO’s license, plus any other statutory sanction applicable d) Professionalism - DPCOs must perform the service with the highest level of professionalism and carry out continuous capacity building for its members of staff, which is a prerequisite for relicensing by the NITDA. DPCOs must not undertake any work for which they lack the requisite skills, manpower and capacity. 7.0 TRANSFER OF PERSONAL DATA ABROAD (Art. 2.11 NDPR) 7.1 The following information is required where data is being transferred abroad: a) the list of countries where the Personal Data of Nigerian citizens and residents is being transferred in the regular course of business; b) the data protection laws of the relevant data protection office/administration of such countries listed in (i) above; c) the privacy policy of the Data Controller, which is NDPRcompliant; d) an overview of the encryption method and data security standards; and e) any other detail that assures the privacy of Personal Data is adequately protected in the target country. 17 | P a g e