-Restricts DCPMIs From Engaging Unregistered Data Processors
Dr. Vincent Olatunji, the National Commissioner and CEO of the Nigeria Data Protection Commission (NDPC), has approved an extension for the registration deadline for Data Controllers and Data Processors of Major Importance (DCPMIs).
The new deadline to register without incurring penalties is now October 31, 2024, according to a release by NDPC and signed by Babatunde Bamigboye, Head, Legal, Enforcement & Regulations at NDPC.
The release stated that in order to ensure accountability and in line with sections 24(3), 29(1a) and 44 of the Nigeria Data Protection Act, 2024 (NDP Act), DCPMIs shall only engage agents and contractors who are duly registered with the Commission (as at 15th October, 2024) for the processing of personal data.
Part of the statement read: “For ease of reference, section 29(1)(a) of the NDP Act provides:
“Where a data controller engages the services of a data processor, or a data processor engages the services of another data processor, the data controller or data processor engaging another shall ensure that the engaged data processor — (a) complies with the principles and obligations set out in this Act as applicable to the data controller;
“Furthermore, Section 65 of the NDP Act defines a data processor “as an individual, private entity, public authority, or any other body, who processes personal data on behalf of or at the direction of a data controller or another data processor.”
The Commission called on data controllers and data processors of major importance to immediately ensure that those who process personal data on their behalf fulfill the obligation to register as required by law.
“Engaging an agent or contractor who does not comply with the principles and obligations (set out in the NDP Act) that are applicable to the data controller is a contravention of the NDP Act,” NDPC warned.