CAR filing guide
The CAR is an annual report on how your organisation handles personal data, filed with the NDPC under NDPA Section 33 by an NDPC-licensed DPCO. Here's who must file, the timeline, and what happens if you're late.
Start your readiness assessment →Free · ~90 seconds · no signup required to see your score.
Who must file
Organisations processing personal data above NDPC thresholds — most fintechs, insurers, health and large-scale data businesses.
Filed by a licensed DPCO
The CAR is produced from a 10-module gap audit and filed by an NDPC-licensed DPCO on your behalf.
Deadline + grace period
There's a headline filing deadline followed by a grace period — after which a 50% surcharge and enforcement risk apply.
Don't let the grace period lapse
The real risk isn't a single date — it's letting the grace window close. Start early so filing is routine, not a scramble.
Find out whether you need to file a CAR this cycle — and get your audit started before the grace period lapses.
Start your readiness assessment →← Back to ADIL · NDPA 2023 · GAID 2025
Ask ADIL
Ask about your clients, audit scores, open flags, or SADPRs.
Reads your live compliance data · Powered by ADIL