Court Affirms NDPC's Powers to Register Major Data Controllers, Processors

The Nigeria Data Protection Commission (NDPC) has claimed that the Federal High Court has upheld its powers to register Data Controllers and Processors of Major Importance (DCPMIs), affirming that the Commission acted within the provisions of the Nigeria Data Protection Act, 2023. The NDPC disclosed this in a statement issued…...

The NDPC disclosed this in a statement issued by its Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, describing the judgment as a major victory for data accountability and regulatory oversight in Nigeria.

According to the statement, the decision followed a suit filed by Emmanuel Harunna against the Commission in Suit No. FHC/L/CS/1116/2024, in which the applicant sought a declaration that Point of Sale (POS) agents are not Data Controllers or Processors of Major Importance under the Nigeria Data Protection Act.

The applicant also asked the court to restrain the Commission from requiring such entities to register.

READ ALSO: NDPC, Meta Partner On Data Protection In Nigeria

However, Justice F.N. Ogazi, after reviewing the NDPC’s Guidance Notice on Registration and relevant provisions of the Nigeria Data Protection Act, ruled that the Commission acted within its statutory mandate in classifying entities under the Major Data Processing – Ordinary High Level (OHL) category as Data Controllers and Processors of Major Importance.

In the judgment, the court held that the registration framework strengthens accountability and enhances the protection of citizens’ personal data.

“The Nigeria Data Protection Act was enacted to promote accountability, transparency and responsible data governance,” the court held.

It further stated that “Registration enables the Respondent to identify entities engaged in significant data processing activities, monitor compliance.”

The court also ruled that the registration requirement does not infringe on citizens’ constitutional rights.

Read Also

According to the judgment, “far from undermining the constitutional right to privacy, the registration framework is one of the statutory mechanism designed to safeguard that very right by subjecting data controllers and data processors to effective regulatory oversight.”

Justice Ogazi further held that the Commission’s Guidance Notice aligns with the constitutional objective of protecting the privacy and security of data subjects.

The court stated, “Looking at the recitals of the Guidance Notice, there is every indication that the Guidance Notice is also aimed at protecting the privacy and security of data subjects, thus bringing the registration requirement of the Guidance Notice within the protective shield of section 45 of 1999 Constitution.”

The judgment also affirmed the supremacy of the Nigeria Data Protection Act in matters relating to personal data processing.

“Remarkably, Section 65 of the Data Protection Act provides that the provisions of the Act shall prevail over any other law inconsistent with its provisions on matter relating to the processing of personal data,” the court added.

Reacting to the judgment, the NDPC described the ruling as a significant advancement in Nigeria’s data protection jurisprudence.

The Commission said its National Commissioner and Chief Executive Officer, Dr Vincent Olatunji, has directed all Data Controllers and Processors of Major Importance that are yet to register with the Commission to do so without delay.

The NDPC warned that failure to comply with the registration requirement could expose affected organisations to legal liabilities, adding that compliance would strengthen public trust and protect the fundamental rights and freedoms of data subjects in Nigeria.