OneTrust DataGuidance Research confirmed, on 31 January 2023, with Olaymika Phillips and Wonuola Abioye, Partner and Senior Associate at Olaniwun Ajayi LP, that the National Data Protection Bureau ('NDPB') had issued the draft code of conduct for data protection compliance organisations ('DPCOs'). In particular, the draft code outlines registration requirements for DPCOs, including that they must register with the NDPB as a condition to rendering compliance services to a data controller or a data processor on the regulatory platforms of the NDPB. Furthermore, the draft code clarifies that the following categories of service providers are eligible for registration as DPCOs, namely professional service consultancy firms, IT service providers, audit firms, and law firms, and that they must have at least one personnel who is verifiably competent in any of the following fields:

• data protection and privacy;
• information privacy;
• data science;
• information audit;
• data management;
• information security;
• data protection legal services;
• information technology due diligence;
• the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR');
• implementation and compliance;
• cybersecurity/cybersecurity law;
• data analytics; and
• data governance.

Furthermore, the draft code outlines compliance services that must be undertaken by the DPCOs, as well as their responsibilities to data subjects, the NDPB, other DPCOs, and clients. Importantly, Phillips and Abioye highlight that "a number of concerns are being raised in the course of the review and a further revised version [will] likely be issued by the NDPB for use".

You can read the draft code here.