The Federal High Court has affirmed the statutory powers of the Nigeria Data Protection Commission (NDPC) to register Data Controllers and Processors of Major Importance (DCPMIs), in a landmark judgment strengthening data accountability and regulatory oversight in Nigeria.
The ruling followed a suit filed by Emmanuel Harunna (Suit No. FHC/L/CS/1116/2024), who sought a declaration that Point of Sale (POS) agents are not Data Controllers or Processors of Major Importance under the Nigeria Data Protection Act, 2023, and an order restraining the Commission from registering such entities.
Delivering judgment, Justice F.N. Ogazi held that the NDPC acted within the powers granted by the Nigeria Data Protection Act, 2023, in designating entities classified under the Major Data Processing – Ordinary High Level (OHL) category as Data Controllers and Processors of Major Importance.
The court, after reviewing the Commission’s Guidance Notice on Registration alongside Sections 5(d), 6(c), 44, 45 and 65 of the Nigeria Data Protection Act, ruled that the registration framework is a lawful mechanism designed to promote accountability, transparency and responsible data governance.
According to the judgment, registration enabled the Commission to identify organisations engaged in significant data processing activities, monitor compliance with data protection obligations, and strengthen regulatory oversight. The court further held that the framework does not infringe on the constitutional right to privacy but rather protect it by ensuring that data controllers and processors operate within established legal standards.
Justice Ogazi also noted that the Guidance Notice is aimed at protecting the privacy and security of data subjects and is therefore protected under Section 45 of the 1999 Constitution. The court further emphasised that Section 65 of the Nigeria Data Protection Act gives the Act overriding effect over any inconsistent law relating to the processing of personal data.
Reacting to the judgment, the NDPC described the decision as a significant milestone in advancing the jurisprudence of data accountability in Nigeria.
The Commission disclosed that its National Commissioner and Chief Executive Officer, Dr Vincent Olatunji, has directed all Data Controllers and Processors of Major Importance that have yet to register with the Commission to do so without delay.
The NDPC warned that failure to comply with the registration requirement exposed affected organisations to legal liabilities under the Nigeria Data Protection Act, while compliance enhances public trust and safeguards the fundamental rights and freedoms of data subjects across the country.
