THE AUDIT
“The audit is due and our evidence is spread across five departments.”
HR, IT, operations and suppliers each hold a piece. Nobody can say what’s complete.
We deliver: an evidence register and an agreed audit plan.
NDPA 2023 · GAID 2025 · NIGERIA
When an auditor, a board member or a customer asks how you handle personal data, you need more than a policy. Keystone builds the records, controls and evidence that answer the question.
Deliverables agreed to your scope.
WHY CLIENTS CALL US
“The audit is due and our evidence is spread across five departments.”
HR, IT, operations and suppliers each hold a piece. Nobody can say what’s complete.
“Can we show we’re compliant, or are we just hoping?”
Unclear owners and open findings make it hard to give management a straight answer.
“What data do you hold on me, and who have you shared it with?”
Records move through many systems, third parties and sometimes overseas.
WHAT CHANGES
TODAY
WITH KEYSTONE
Evidence file · v1.0THE LEGAL FRAMEWORK
The Nigeria Data Protection Act 2023 sets the rules. The General Application and Implementation Directive, effective 19 September 2025, spells out how to meet them. Compliance is a legal obligation for organisations within scope.
References: NDPC · GAID 2025 · NDPC guidance
SERVICES
Every engagement starts with an agreed scope and ends with records your team keeps.
Gap assessment, preliminary and final audit work, management responses, remediation review and support for Compliance Audit Returns.
Processing records, notices, retention schedules and processor agreements that reflect how you actually work.
Assess higher-risk processing and cross-border flows before a new system goes live.
Owners, stewards, quality rules and lifecycle controls that link policy to daily work.
Compliance calendars, role-based awareness and action tracking between audit cycles.
Map AI use, exposure and oversight. Set proportionate policies before you scale.
HOW IT WORKS
Agree the entities, systems, obligations and outputs that matter.
Interview owners, review records and test how controls operate.
Develop documents, assign actions and support implementation.
Review closure evidence, support submissions and keep progress visible.
SECTORS
Customer onboarding, identity records, credit processes and outsourced services create an interconnected privacy landscape.
WHO YOU’LL WORK WITH
Data Protection & Governance · Keystone
More than a decade in data management, enterprise architecture and AI risk, including work with major UK banks, central government, public sector and health organisations. Her focus: turning governance requirements into processes, clear responsibilities and controls that work.
Backed by Keystone Marine & Logistics: procurement, engineering and logistics for Nigeria’s energy sector since 2009. About Keystone
QUESTIONS
GAID applies to organisations that process personal data within the scope of the Nigeria Data Protection Act 2023. What you must do depends on how your organisation is classified. We confirm where you stand in the first conversation.
Filing duties depend on your classification, so they are not the same for every organisation. We help you confirm what applies and prepare the supporting records.
A policy states your intentions. Auditors and regulators look for evidence it works in practice: processing records, assessments, supplier contracts, training records and incident procedures.
Yes. We work alongside your existing teams, support the DPO function and leave records your people can maintain after the engagement.
No. An audit shows your position at a point in time and what needs to change. It gives you a clear, defensible account of your compliance work, not a guarantee of approval.
A short outline of your organisation, the kinds of personal data you handle, upcoming deadlines and the documents you already have. Nothing sensitive is needed at this stage.
TAKE THE NEXT STEP
Tell us about your organisation and your deadlines. We’ll come back with a scope that fits.