The National Information Technology Development Agency [NITDA] is empowered under Section 6 of the National Information Technology Development Agency Act 2007 to regulate and promote the development and use of Information Technology in Nigeria, including through the development of IT frameworks, standards, guidelines, regulations and policies.

Pursuant to this mandate, NITDA has established a registration framework for Indigenous IT Service Providers/Consultants and Contractors seeking to provide IT services to Federal Government Ministries, Departments and Agencies [MDAs], whether through the procurement process or Public-Private Partnerships [PPP].

The purpose of the registration is to promote professionalism, ensure that competent IT providers are engaged by government and strengthen indigenous capacity in the Nigerian ICT sector. Registered IT service providers are listed in NITDA's National Database of Indigenous IT Companies in Nigeria.

Who is required or eligible to register?

The NITDA IICP registration framework applies principally to indigenous IT service providers, consultants and contractors seeking to provide IT services to Federal Government MDAs.

The guidelines identify IT service providers/contractors to include, among others:

IT consulting firms;
software development and deployment companies;
business process operating firms; and
other companies providing identified IT services to Federal Government MDAs.
A company is considered an indigenous IT service provider under the published guidelines where it is registered in Nigeria with the Corporate Affairs Commission [CAC] and Nigerians hold more than 51% of its issued shares.

It is therefore important to distinguish NITDA IICP registration from other regulatory obligations applicable to technology businesses.

For example, a company does not become subject to IICP registration merely because it operates an e-commerce platform, processes personal data, collects names, email addresses or BVNs, or provides a digital service. Such activities may trigger obligations under the applicable data protection and sector-specific regulatory frameworks, but they do not, by themselves, establish the requirement for NITDA IICP registration.

Conditions for NITDA Registration

Under the published guidelines, NITDA will consider applicants that:

are indigenous IT service providers;
have their websites hosted on a .ng domain; and
have demonstrated sufficient capacity to provide the IT services for which registration is sought.
Proof of competence

Applicants must demonstrate:

verifiable technical or professional competence and capacity;
sufficient competent personnel on their payroll to provide the identified IT services; and
that their competent personnel are not substantially made up of transient or temporary personnel such as consultants, contract staff or casual staff.

In addition, at least one Principal Officer of the applicant must be registered with the Computer Professionals [Registration Council of Nigeria] [CPN].

Where NITDA is unable to determine an applicant's competence from the documents submitted, the Agency may schedule an interview or other verification process to assess the applicant's capacity.

Expatriate Staff

Where an applicant employs expatriate staff, the company must provide evidence of an approved expatriate quota.

The guidelines further provide that expatriate personnel will only be considered as evidence of the applicant's competence where:

there is sufficient evidence that the required skills cannot be provided by Nigerians;
the expatriate's skills are relevant to the disclosed job description; and
the applicant demonstrates a succession plan for Nigerians to replace the expatriate at the expiration of the expatriate quota.

Documents and Requirements

The applicant is required to complete the prescribed application process and submit the supporting documents required by NITDA.

The published guidelines expressly require, among other things:

a completed NITDA application form;
the required supporting documents;
an application letter addressed to the Director-General of NITDA;
evidence demonstrating the company's competence and capacity;
evidence of competent personnel;
evidence of CPN registration of at least one Principal Officer;
approved expatriate quota, where applicable; and
the company's relevant Service Level Agreements [SLAs].

The precise supporting documents required should be confirmed from the current NITDA application portal because NITDA requires applicants to upload the documents specified in the application process.

Service Level Agreement [SLA]

Applicants are required to submit the standardized SLAs issued to their clients.

The SLA should address, among other matters:

standards of service;
delivery timelines;
responsibilities of each party;
monitoring and reporting;
legal and regulatory compliance;
payment terms;
dispute resolution;
confidentiality and non-disclosure; and
termination.
Registration Process and Certificate

Applications are submitted through NITDA's Indigenous IT Company Registration Portal, together with the required supporting information and documents. NITDA may verify the information supplied by the applicant before issuing the substantive certificate.

Under the published guidelines:

a provisional certificate is initially issued for six months;

during that period, NITDA undertakes verification of the information supplied;

where the applicant satisfies the requirements, a substantive certificate is issued; and

the substantive certificate is valid for two years, commencing from the date of issuance of the provisional certificate.

Applications for renewal of a substantive certificate should be submitted at least three months before its expiration.

What is the Difference Between NITDA Registration and Data Protection Compliance?

These are different regulatory requirements and should not be treated as alternatives.

NITDA IICP Registration

NITDA's IICP registration is directed principally at IT service providers, consultants and contractors seeking to provide IT services to Federal Government MDAs.

Its focus includes the provider's technical competence, personnel, capacity and ability to deliver identified IT services.

Data Protection Compliance

Data protection compliance concerns the processing of personal data and is governed principally by the Nigeria Data Protection Act 2023 and the regulatory framework administered by the Nigeria Data Protection Commission [NDPC].

A company may therefore be required to comply with data protection requirements because of the nature and scale of its processing activities, even where it has no NITDA IICP registration obligation.

Conversely, an IT service provider seeking to provide services to a Federal Government MDA may require NITDA registration even though the particular service may not involve processing personal data.

NITDA registration should therefore not be presented as a substitute for data protection compliance, and data protection compliance does not automatically amount to NITDA IICP registration.

NITDA Registration and Government Contracts

A company intending to provide IT services to a Federal Government Ministry, Department or Agency should consider NITDA IICP registration as part of its government procurement and regulatory compliance requirements.

However, NITDA registration does not by itself guarantee the award of a government contract. The company must still satisfy the applicable procurement, technical, financial, tax, corporate and other requirements stipulated for the particular procurement.

Similarly, NITDA registration should not be presented as a universal replacement for other government procurement registrations or certifications that may be required for a particular contract.

Change in Company Information

Where there is a change in facts or information supplied by the applicant during registration, verification or after issuance of the certificate, the published guidelines require NITDA to be notified within 45 days of the change.

Why Registration Matters

For an ICT company targeting Federal Government IT projects, NITDA registration provides an important regulatory and procurement credential.

Registered IT service providers are included in NITDA's National Database of Indigenous IT Companies in Nigeria, allowing their identified capabilities to be recorded within the Agency's database.

Important Note

NITDA's published materials should be checked at the point of application because the Agency has been reviewing its ICT service provider registration guidelines, and its more recent service materials do not completely align with the older 2018 guidelines on matters such as certificate validity and processing timelines.

Accordingly, businesses should confirm the current requirements on the NITDA registration portal before commencing an application.