The Federal High Court has affirmed the powers of the Nigeria Data Protection Commission (NDPC) to register Point of Sale (PoS) agents and other organisations classified as Data Controllers and Data Processors of Major Importance (DCPMIs).

This further established the commission’s authority to regulate entities engaged in significant personal data processing.

The judgment, delivered by Justice F.N. Ogazi, also dismissed an attempt to restrain the commission from enforcing the registration requirement under the Nigeria Data Protection Act (NDPA), 2023.

The case, Emmanuel Harunna v. Nigeria Data Protection Commission (FHC/L/CS/1116/2024), arose after the applicant asked the court to declare that PoS agents are not Data Controllers or Processors of Major Importance and sought a perpetual injunction preventing the commission from registering them.

However, after reviewing the NDPC’s Guidance Notice on Registration alongside Sections 5(d), 6(c), 44, 45 and 65 of the Nigeria Data Protection Act, Justice Ogazi held that the commission acted within the powers conferred on it by law in designating entities within the Ordinary High Level (OHL) category of major data processing as Data Controllers and Processors of Major Importance.

The court ruled that the Nigeria Data Protection Act was enacted “to promote accountability, transparency and responsible data governance,” adding that the registration framework enables the commission to identify organisations involved in significant data processing activities and effectively monitor their compliance with the law.

It further held that the registration requirement does not infringe on the constitutional right to privacy but instead serves as one of the statutory mechanisms designed to safeguard that very right by subjecting data controllers and data processors to effective regulatory oversight.

Justice Ogazi also held that the commission’s Guidance Notice was aimed at protecting the privacy and security of data subjects, bringing it within the protective provisions of Section 45 of the 1999 Constitution.

The court further observed that Section 65 of the Nigeria Data Protection Act gives the law overriding effect over any inconsistent legislation on matters relating to the processing of personal data.

Reacting to the judgment, the NDPC described the decision as a significant milestone in advancing data protection jurisprudence and strengthening accountability in Nigeria’s digital ecosystem.

The commission disclosed that its National Commissioner and Chief Executive Officer, Dr. Vincent Olatunji, has directed all Data Controllers and Data Processors of Major Importance that are yet to register with the commission to do so without delay.

According to the commission, registration enhances public trust, promotes responsible data governance and protects the fundamental rights and freedoms of data subjects.

It warned that organisations that fail to comply with the registration requirement expose themselves to legal liabilities under the Nigeria Data Protection Act.