The Nigeria Data Protection Commission (NDPC) has secured what could become one of the most consequential judicial endorsements of Nigeria’s data protection framework since the enactment of the Nigeria Data Protection Act (NDPA), 2023, with a Federal High Court ruling affirming the Commission’s statutory authority to require the registration of Data Controllers and Data Processors of Major Importance (DCPMIs).
The judgment, delivered in Emmanuel Harunna v. Nigeria Data Protection Commission (FHC/L/CS/1116/2024), strengthens the legal foundation of Nigeria’s emerging privacy regulatory framework and provides judicial clarity on one of the NDPC’s most significant compliance requirements.
Beyond resolving the dispute before the court, the decision is expected to shape how organisations across banking, telecommunications, healthcare, education, digital services, e-commerce and financial technology approach compliance with Nigeria’s data protection laws.
Court dismisses challenge to NDPC registration powers
The applicant had asked the Federal High Court to declare that Point of Sale (PoS) agents are not Data Controllers or Data Processors of Major Importance and sought an order restraining the Commission from requiring their registration.
The court, however, dismissed the application, holding that the NDPC acted within the powers granted to it under the Nigeria Data Protection Act by designating entities classified under the Major Data Processing – Ordinary High Level (OHL) category as Data Controllers and Data Processors of Major Importance.
In its judgment, the court also held that Section 63 of the NDPA gives the Act overriding effect in matters relating to personal data processing, meaning its provisions prevail where there is inconsistency with other legislation governing personal data.
The court further found that the Commission’s Guidance Notice serves the legitimate objective of protecting the privacy and security of individuals whose personal information is processed.
According to the judgment, the registration requirement falls within the limitations permitted under Section 45 of the 1999 Constitution, which allows laws enacted in the interests of public safety, public order and the protection of the rights and freedoms of others.
“The Nigeria Data Protection Act was enacted to promote accountability, transparency and responsible data governance. Registration enables the Respondent to identify entities engaged in significant data processing activities, monitor compliance… Far from undermining the constitutional right to privacy, the registration framework is one of the statutory mechanisms designed to safeguard that very right by subjecting data controllers and data processors to effective regulatory oversight,” the court held.
Following the ruling, the NDPC directed organisations that qualify as Data Controllers and Data Processors of Major Importance but have yet to register with the Commission to do so without delay.
According to the Commission, failure to register exposes organisations to legal liabilities under the Nigeria Data Protection Act, while compliance strengthens public confidence and protects the fundamental rights and freedoms of Nigerian data subjects.
Data protection: Why the court ruling matters
The significance of the judgment extends beyond the immediate parties involved.
As Nigeria’s digital economy expands through fintech, artificial intelligence, cloud computing, e-commerce, digital identity, telecommunications and public digital infrastructure, organisations increasingly process enormous volumes of personal data.
Regulators worldwide have recognised that organisations processing large quantities of sensitive personal information require closer regulatory supervision because data breaches, misuse or unlawful processing can affect millions of individuals.
The Federal High Court’s decision effectively reinforces the NDPC’s authority to identify these organisations and subject them to enhanced oversight under the NDPA.
For Nigeria’s data protection ecosystem, the ruling provides stronger legal certainty for enforcement activities that had previously faced questions over the Commission’s powers.
One of the biggest implications of the judgment is regulatory certainty.
Businesses have increasingly sought clarity regarding which organisations qualify as Data Controllers or Data Processors of Major Importance and whether the Commission possessed sufficient statutory authority to compel registration.
By affirming the NDPC’s powers under the NDPA, the court has reduced legal uncertainty surrounding one of the Commission’s primary regulatory tools.
This clarity is particularly significant for investors and multinational companies evaluating Nigeria’s digital economy.
Predictable regulatory frameworks are generally regarded as essential ingredients for digital investment because they define compliance expectations while reducing uncertainty over enforcement.
As Nigeria’s digital economy expands through fintech, artificial intelligence, cloud computing, e-commerce, digital identity, telecommunications and public digital infrastructure, organisations increasingly process enormous volumes of personal data. Regulators worldwide have recognised that organisations processing large quantities of sensitive personal information require closer regulatory supervision because data breaches, misuse or unlawful processing can affect millions of individuals.
Stronger oversight for high-impact data processing
The ruling also reinforces the concept of risk-based regulation embedded within the Nigeria Data Protection Act.
Rather than treating every organisation identically, the NDPA recognises that entities processing large volumes of personal information or operating critical digital infrastructure require more intensive supervision.
Under the Commission’s Guidance Notice, organisations may fall within the DCPMI framework if they process the personal data of more than 200 individuals within six months, provide commercial ICT services that process user data, or operate in sectors including communications, financial services, healthcare, education, aviation and digital platforms, depending on the nature and scale of their processing activities.
The judgment therefore strengthens the Commission’s ability to identify organisations whose data processing activities present higher risks to citizens’ privacy.
Implications for fintech and PoS operators
Although the case originated from a challenge concerning Point of Sale agents, the implications extend far beyond the payments ecosystem.
Nigeria’s fintech sector has experienced rapid expansion, with payment service providers, agency banking networks, lending platforms and digital financial services processing millions of customer records daily.
The judgment sends signals that organisations cannot assume exemption simply because they operate within broader payment ecosystems.
Instead, whether an entity qualifies as a Data Controller or Data Processor of Major Importance will depend on the statutory framework and the nature, volume and significance of its personal data processing activities.
Nigeria’s fintech sector has experienced rapid expansion, with payment service providers, agency banking networks, lending platforms and digital financial services processing millions of customer records daily. The judgment sends signals that organisations cannot assume exemption simply because they operate within broader payment ecosystems.
Another notable aspect of the judgment is its treatment of privacy rights.
Rather than viewing registration as an administrative burden that limits business operations, the court characterised it as a mechanism that strengthens constitutional privacy protections.
By linking the registration framework to Section 45 of the Constitution, the court recognised that regulatory oversight can serve legitimate public interests where it protects the rights and freedoms of individuals.
This interpretation could become influential in future litigation involving privacy regulation, cybersecurity obligations and digital governance.
The ruling is also expected to elevate data governance within corporate boardrooms.
Registration as a DCPMI is only one component of broader compliance obligations under the Nigeria Data Protection Act.
Affected organisations may also be expected to demonstrate stronger governance structures, maintain appropriate technical and organisational safeguards, conduct compliance assessments where required, cooperate with regulatory investigations and implement measures to protect personal information throughout its lifecycle.
For many organisations, the decision reinforces the need to treat data protection as an enterprise risk issue rather than merely an IT or legal compliance function.
The Nigeria Data Protection Act, 2023, fundamentally reshaped the country’s privacy ecosystem by establishing the Nigeria Data Protection Commission (NDPC) as an independent regulator with statutory powers to enforce data protection rights, investigate violations, issue compliance directives and regulate personal data processing.
The Act aligns Nigeria more closely with global privacy trends that increasingly place accountability, transparency and responsible data governance at the centre of digital economic development.
As digital identity systems, financial technology, artificial intelligence and cloud-based services continue to expand, effective regulation of personal data is expected to become increasingly important for consumer trust and investor confidence.
A milestone for Nigeria’s data protection regime
The Federal High Court’s decision represents more than a procedural victory for the NDPC.
It provides judicial affirmation of the Commission’s authority to implement one of the cornerstone provisions of the Nigeria Data Protection Act, while reinforcing the principle that organisations entrusted with significant volumes of personal information must be subject to appropriate regulatory oversight.
For businesses, the ruling signals that compliance with data protection obligations is becoming an increasingly important component of corporate governance.
For citizens, it strengthens the legal framework intended to safeguard personal information in an economy that is becoming ever more digital.
As enforcement activity under the NDPA continues to mature, the judgment is likely to serve as an important judicial precedent supporting Nigeria’s ambition to build a trusted, accountable and internationally credible data protection ecosystem.
Author
Home
