The Nigeria Data Protection Commission (NDPC) has recorded a major legal victory after the Federal High Court upheld its statutory authority to designate and register Data Controllers and Data Processors of Major Importance (DCPMIs), reinforcing the Commission’s regulatory mandate under the Nigeria Data Protection Act (NDPA), 2023.
The judgment was delivered in the suit Emmanuel Harunna v. Nigeria Data Protection Commission (FHC/L/CS/1116/2024), where the applicant sought a declaration that Point of Sale (POS) agents do not qualify as Data Controllers or Data Processors of Major Importance under the NDPA and asked the court to restrain the Commission permanently from requiring their registration.
In a comprehensive judicial review, Honourable Justice F.N. Ogazi examined the Commission’s Guidance Notice on Registration alongside Sections 5(d), 6(c), 44, 45 and 65 of the Nigeria Data Protection Act, 2023, before ruling that the Commission acted within the powers conferred on it by law in classifying entities within the Ordinary High Level (OHL) category of major data processing as Data Controllers and Data Processors of Major Importance.
The court held that the registration framework established by the Commission is consistent with the objectives of the NDPA and serves as a critical mechanism for strengthening accountability and regulatory oversight in Nigeria’s data protection ecosystem.
In its judgment, the court observed that the Nigeria Data Protection Act was enacted to promote accountability, transparency and responsible data governance, noting that the registration requirement enables the Commission to identify organisations engaged in significant data processing activities and effectively monitor their compliance with the law.
The court further ruled that the registration framework does not undermine the constitutional right to privacy but rather strengthens it by subjecting data controllers and processors to appropriate regulatory oversight.
It also held that the Commission’s Guidance Notice was designed to protect the privacy and security of data subjects, thereby bringing the registration requirement within the protective provisions of Section 45 of the 1999 Constitution.
Justice Ogazi also affirmed the supremacy of the Nigeria Data Protection Act on matters relating to personal data processing, pointing to Section 65 of the Act, which provides that its provisions prevail over any other law that is inconsistent with it in matters concerning the processing of personal data.
The Commission described the judgment as a significant milestone in the advancement of data protection jurisprudence in Nigeria, saying it further validates the legal framework established to promote responsible data governance and protect the rights of data subjects.
Following the judgment, the National Commissioner and Chief Executive Officer of the NDPC, Dr. Vincent Olatunji, has directed all Data Controllers and Data Processors of Major Importance that are yet to register with the Commission to do so without delay.
The Commission warned that failure to comply with the registration requirement exposes defaulting organisations to serious legal liabilities under the Nigeria Data Protection Act, while timely registration enhances public confidence, strengthens regulatory compliance, and safeguards the fundamental rights and freedoms of data subjects across Nigeria.