Frequently Asked Questions (FAQ)

Amstel Consulting is a data protection, privacy, governance and cybersecurity advisory firm supporting private companies, regulated businesses, multinational organisations and public-sector institutions in Nigeria and internationally.

Yes. Amstel Consulting is a licensed Data Protection Compliance Organisation (DPCO), providing organisations with professional support in meeting their obligations under Nigeria’s data protection framework.

We provide data protection compliance, outsourced DPO services, Compliance Audit Return (CAR) support, privacy audits, DPIAs, ROPA, privacy documentation, staff training, vendor assessments, breach response support and cybersecurity advisory services.

A DPCO is an organisation licensed to provide professional data protection compliance services, including compliance assessments, audits and regulatory support under Nigeria’s data protection framework.

An outsourced DPO provides the organisation with an external privacy professional who performs the DPO function without the organisation having to maintain a full-time internal DPO.

Certain organisations are required to designate a Data Protection Officer depending on their processing activities and applicable regulatory requirements. We can assess your organisation and advise on the appropriate DPO structure.

Yes. We provide outsourced DPO services supported by a multidisciplinary team of privacy, compliance, legal and cybersecurity professionals.

A Compliance Audit Return is part of the NDPC’s accountability framework for assessing and documenting an organisation’s compliance with applicable data protection requirements.

CAR requirements depend on your organisation’s activities and its applicable classification under Nigeria’s data protection framework. We can assess your organisation and determine the compliance and filing requirements that apply.

Yes. Where your organisation is required to file a CAR, we can manage the process from compliance assessment and remediation through verification, preparation and submission of the return.

We review your organisation’s data processing activities, governance framework, policies, procedures, security measures and compliance documentation to identify gaps and recommend practical corrective actions.

An NDPA Gap Assessment evaluates your current privacy and data protection practices against applicable requirements and identifies areas requiring improvement, remediation or further review.

A DPIA is a structured assessment used to identify and manage privacy risks associated with processing activities that may present heightened risks to individuals.

A ROPA documents how personal data is collected, used, stored, shared and otherwise processed across an organisation. It provides an important foundation for effective privacy governance and accountability.

Yes. We assist organisations with privacy notices, internal data protection policies, data retention frameworks, consent documentation, data processing agreements, breach procedures and other compliance documentation.

Yes. We provide practical data protection and privacy training for employees, management teams, DPOs and other personnel, tailored to the organisation’s sector, operations and risk profile.

Yes. We can support your organisation in assessing the incident, coordinating the privacy and compliance response, documenting the breach, evaluating notification obligations and strengthening controls following the incident.

Yes. Our multidisciplinary approach combines privacy and data protection compliance with cybersecurity advisory, helping organisations address both governance requirements and technical risks.

Yes. Our network includes professionals across Nigeria, Europe and the Americas, enabling us to support Nigerian and international organisations dealing with Nigerian data protection requirements and broader privacy and governance considerations.

Start with a free NDPA Gap Assessment or contact our advisory team directly. We will review your organisation’s requirements and recommend the appropriate compliance, DPO, audit, training or cybersecurity support.