Own the obligations register and compliance calendar across the NDPC, CBN (through bank clients), NITDA, NRS, ngCERT, PCI SSC, PenCom, NSITF, ITF and the CAC; monthly attestation from each owner.
Run the data protection programme with the DPO: registration, annual audit return, records of processing, impact assessments before high-risk processing, processor agreements with every client and sub-processor, transfer records and staff training.
Own the regulatory incident clocks (client notice; 24-hour CBN through bank clients; 72-hour ngCERT and NDPC); keep and drill the playbook with the CISO and Legal.
Plan and evidence data residency against the CBN circular and NITDA's sovereign data tiers before each deadline and market.
Run the integrated management system across ISO 27001, 9001, 22301 and 20000-1: internal audit programme, management reviews, corrective actions, Statement of Applicability and the role managers' calendar; host the annual surveillance audit and the 2028 recertification; lead the ISO 9001:2026 transition and the ISO 27001 scope extension.
Coordinate attestations with the CISO's team (SOC 2 Type II, SOC 1 readiness, PCI DSS service-provider readiness) and maintain the client assurance pack; answer due-diligence questionnaires within an agreed turnaround.
Run the policy cycle on the Policy Hub; check marketing and bid claims so HT only claims what is certified; issue a quarterly regulatory update to EMC, feeding the CRO's Board report.
Why now
From 1 January 2027 HT holds payroll, health and loan data for seven companies and must meet data residency rules; e-invoicing licences carry uptime, testing and reporting conditions.
External clients buy on certificates and attestations; one failed surveillance audit would put all four ISO certificates at risk, and the system is run by the CRO with no deputy.
External benchmark: NDPC fined Fidelity Bank 555.8m (2024), partly for reliance on non-compliant third-party processors, and MultiChoice 766.2m (2025); 1,369 firms are under review. ISO Survey 2024: 96,709 ISO 27001 certificates worldwide, increasingly required at tender.
Experience and qualifications
7+ years in compliance, data protection or management-system roles in a regulated technology company, fintech or bank
Deep knowledge of the NDPA 2023 and GAID 2025; CBN and NITDA frameworks
ISO/IEC 27001 Lead Auditor or Implementer; experience of at least one of ISO 9001, 22301 or 20000-1; SOC 2 or PCI DSS project experience
NDPC-recognised DPO credential, CIPP/E or CIPM an advantage; legal training an advantage Risks it leads on