By Esther Olaoluwa |
Point of Sale (PoS) agents across Nigeria are now required to register with the Nigeria Data Protection Commission (NDPC) following a Federal High Court judgment affirming the Commission’s authority to regulate them as Data Controllers and Processors of Major Importance (DCPMIs) under the Nigeria Data Protection Act (NDPA) 2023.
The ruling, delivered in the case of Emmanuel Harunna v. Nigeria Data Protection Commission (FHC/L/CS/1116/2024), dismissed a legal challenge seeking to exempt PoS agents from the registration requirement, paving the way for the Commission to enforce compliance across the sector.
Court Affirms NDPC’s Regulatory Authority
According to the NDPC, the applicant had asked the court to declare that PoS agents should not be classified as Data Controllers and Processors of Major Importance under the Nigeria Data Protection Act and sought an order restraining the Commission from enforcing their registration.
However, Justice F.N. Ogazi held that the Commission acted within its statutory powers by designating organisations and entities engaged in Ordinary High Level (OHL) Major Data Processing as Data Controllers and Processors of Major Importance.
The court ruled that the registration framework aligns with the objectives of the Nigeria Data Protection Act by promoting accountability, transparency and responsible management of personal data.
It further held that registration enables the Commission to identify organisations involved in significant data processing activities and monitor their compliance with data protection obligations.
The judge also ruled that the registration requirement does not violate the constitutional right to privacy but rather strengthens the protection of personal data by bringing data controllers and processors under effective regulatory oversight.
NDPC Directs Immediate Compliance
Following the judgment, the National Commissioner and Chief Executive Officer of the NDPC, Dr. Vincent Olatunji, directed all Data Controllers and Processors of Major Importance that have not yet registered with the Commission to do so immediately.
The directive was contained in a statement signed by the Commission’s Head of Legal, Enforcement and Regulations, Babatunde Bamigboye.
The Commission warned that organisations and businesses that fail to comply with the registration requirement could face legal liabilities under the Nigeria Data Protection Act.
According to the NDPC, compliance with the registration framework will strengthen public trust while protecting the rights and freedoms of individuals whose personal data are processed.
The Commission also noted that the judgment reaffirmed the supremacy of the Nigeria Data Protection Act, with the court holding that Section 65 of the Act prevails over any inconsistent law relating to data protection.
Registration Framework
The NDPC had issued a Guidance Notice in 2024 outlining the categories of organisations required to register as Data Controllers and Processors of Major Importance.
According to the Commission, organisations considered to be of significant value to Nigeria’s economy, society or national security fall within the registration framework.
To promote ease of doing business, particularly for smaller organisations involved in potentially high-risk data processing, the Commission classifies Major Data Processing into three categories: Ultra High Level (UHL), Extra High Level (EHL) and Ordinary High Level (OHL).
Registration fees are set at ₦250,000 for UHL entities, ₦100,000 for EHL entities and ₦10,000 for OHL entities.
With the court’s decision, the NDPC is expected to intensify enforcement of the registration framework, requiring affected organisations, including PoS agents, to comply with the provisions of the Nigeria Data Protection Act.
Share this
