Processors, to ensure that they are in compliance with the requirements of the NDPR and their data protection policies. NITDA may at its discretion: a) carry out scheduled audits; b) require report of audits as carried out by an organisation’s DPCO; or c) schedule “spot check” or “special audits” to ascertain compliance or identify breaches. 6.2 The reasons for conducting a data protection audit include to: a) assess the level of compliance with the NDPR; b) evaluate compliance with the organisation's own data protection policy; c) identify potential gaps and weaknesses in organisation’s processes; and d) give requisite advice and/or remedial actions for identified gaps. 6.3 Audit Filing Fees (Art. 4.1(5) NDPR) Each Data Controller and Administrator is expected to file its audit report through a DPCO and pay the following amount as applicable2: 6.4 2 SN Number of Data Subjects Amount 1 Less than 2,000 N10,000 2 2,000 data subjects and above N20,000 Content of Audit Report (Art. 4.1(5) NDPR) NITDA in its discretion may vary the applicable fees and notify stakeholders accordingly. 14 | P a g e