Terms of Service & DPCO SLA Agreement

1. Sovereign Legal Basis & NDPA 2023 Statutory Governance

This Master Software-as-a-Service (SaaS) Agreement and Data Processing Addendum (DPA) is entered into between TrustGuard NG (a sovereign compliance technology product operated under the 9jaonCloud enterprise suite) and the subscribing legal entity (the "Data Controller" or "Data Processor").

All services, autonomous risk telemetry engines, and compliance modules provided by TrustGuard NG are strictly governed by the provisions of the Nigeria Data Protection Act (NDPA) 2023, the NDPC General Application and Implementation Directive (GAID) 2025, and associated statutory regulatory guidelines issued by the Nigeria Data Protection Commission (NDPC).

Lawful Basis Requirement:

Subscriber entities represent and warrant that all personal data uploaded into the TrustGuard NG SaaS platform is collected and processed under an established lawful basis as mandated by Section 25 of the NDPA 2023 (Consent, Contractual Obligation, Legal Obligation, Vital Interests, Public Task, or Legitimate Interests).

2. Mandatory 72-Hour Breach Notification Protocol (Section 40)

In accordance with Section 40 of the NDPA 2023 and GAID 2025 Incident Reporting Frameworks, TrustGuard NG provides automated statutory breach triage and telemetry. In the event of a confirmed or reasonably suspected personal data breach:

Automated Telemetry Dispatch: The platform initiates immediate incident forensic logging and triggers the statutory 72-hour countdown timer upon ticket creation.
Form NDPC-001 Generation: TrustGuard NG automatically drafts the statutory preliminary breach disclosure dossier (Form NDPC-001) for designated Data Protection Officers (DPOs) and licensed DPCO review.
Data Subject Communication: Where high-risk harm to data subjects is determined, the platform provisions standardized data subject advisory notifications within statutory windows.

3. AI Schedule 4 DPIA Execution & Statutory Audit Warranty

TrustGuard NG includes native automated Data Protection Impact Assessment (DPIA) engines aligned with Schedule 4 of the NDPA 2023 and GAID 2025 High-Risk Processing thresholds (including biometric processing, automated credit scoring, behavioral tracking, and large-scale healthcare data).

All Compliance Audit Returns (CAR) compiled using the platform undergo pre-submission statutory dry runs against the 120-parameter NDPC Regulatory Scoring Rubric. The system issues cryptographic hash seals on all exported audit packages to guarantee chain-of-custody evidentiary integrity during DPCO filing and regulatory scrutiny.

4. Enterprise Service Level Agreement (SLA) & Availability

TrustGuard NG warrants an annual service uptime availability of 99.98% Uptime across all compliance API endpoints, incident telemetry receptors, and DPCO filing hubs (excluding scheduled off-peak maintenance announced 72 hours in advance).

Severity Level	Incident Definition	Target Response Time	Resolution SLA
Critical (Sev 1)	Total platform outage or active 72h statutory breach filing block	≤ 15 Minutes	≤ 2 Hours
Major (Sev 2)	DPIA calculation error or automated ROPA export degradation	≤ 1 Hour	≤ 6 Hours
Minor (Sev 3)	General dashboard query, cosmetic UI issue, CPD report query	≤ 4 Hours	≤ 24 Hours

5. Cryptographic Encryption & Enterprise Security Architecture

To satisfy Section 39 of the NDPA 2023 (Security of Processing), TrustGuard NG enforces military-grade technical and organizational security controls:

Data at Rest: Encrypted using AES-256-GCM with hardware-backed KMS key rotation.
Data in Transit: Enforced strictly over TLS 1.3 / HTTPS with HTTP Strict Transport Security (HSTS) and Perfect Forward Secrecy (PFS).
Immutable Audit Logging: All user logins, compliance rule mutations, DPIA signoffs, and breach records are written to append-only tamper-evident cryptographic log streams.
Role-Based Access Control (RBAC): Granular permission models isolating Lead Auditors, Internal DPOs, Executive Approvers, and Guest DPCO Inspectors.

6. Data Subject Access Requests (DSAR) Turnaround

Under Sections 34 through 38 of the NDPA 2023, data subjects maintain inviolable rights of access, rectification, erasure, restriction, and portability. The TrustGuard NG DSAR Engine tracks statutory deadlines and enforces automated workflows ensuring customer fulfillment within the mandatory 30-calendar-day statutory window.

7. Cross-Border Data Transfer Framework (Sections 41 & 42)

The platform provides pre-built Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), and Country Adequacy Verification matrices to ensure all cross-border data flows comply with NDPC White-listed Jurisdictions and lawful transfer derogations.

8. Sovereign Data Residency & Jurisdiction

All primary data stores, compliance evidence repositories, and statutory registry backups are maintained in high-security Tier-III and Tier-IV data center facilities compliant with Nigerian Sovereign Data Residency regulations and National Information Technology Development Agency (NITDA) directives.

9. DPCO Indemnity, Limitation of Liability & Disclosures

TrustGuard NG provides autonomous software tools, automated templates, and compliance scoring to assist Data Controllers and Processors in achieving regulatory adherence. The software is not a substitute for formal legal counsel. Formal filing of annual statutory returns must be countersigned by an accredited Data Protection Compliance Organization (DPCO) licensed by the NDPC.

Questions regarding these Terms or DPCO Partnership agreements?

Contact DPCO Desk

SaaS Terms of Service & DPCO Service Level Agreement