The Federal High Court has affirmed the statutory authority of the Nigeria Data Protection Commission (NDPC) to require the registration of Data Controllers and Data Processors of Major Importance (DCPMIs), strengthening Nigeria’s data governance and regulatory framework.
The decision was delivered by Justice F.N. Ogazi in the case of Emmanuel Harunna v. Nigeria Data Protection Commission (FHC/L/CS/1116/2024), according to a statement signed by the NDPC’s Head of Legal, Enforcement and Regulations, Babatunde Bamigboye.
The applicant had sought a declaration that Point of Sale (POS) agents do not qualify as Data Controllers or Data Processors of Major Importance under the Nigeria Data Protection Act (NDPA). He also requested a perpetual injunction preventing the Commission from requiring such agents to register as DCPMIs.
However, the court dismissed the suit after examining relevant provisions of the NDPA, including Sections 5(d), 6(c), 44, 45 and 65, as well as the NDPC’s Guidance Notice on Registration.
Justice Ogazi held that the Commission acted within its statutory powers in designating entities engaged in Major Data Processing – Ordinary High Level (OHL) as Data Controllers and Data Processors of Major Importance.
The court noted that the NDPA was enacted to promote accountability, transparency and responsible data governance, adding that the registration framework enables the Commission to identify organisations engaged in significant data processing, monitor compliance and strengthen regulatory oversight.
It further ruled that the registration requirement does not infringe the constitutional right to privacy but instead serves as a statutory mechanism for protecting that right through effective regulatory supervision. The court also found that the objectives of the Guidance Notice are consistent with constitutional protections for privacy and the security of personal data under Section 45 of the 1999 Constitution.
In addition, the court emphasised that Section 63 of the Nigeria Data Protection Act gives the legislation overriding effect over any inconsistent law relating to the processing of personal data.
Reacting to the judgment, the NDPC described the ruling as a landmark development for data protection jurisprudence in Nigeria.
Following the decision, the National Commissioner and Chief Executive Officer of the NDPC, Dr Vincent Olatunji, directed all Data Controllers and Data Processors of Major Importance that have not yet registered with the Commission to do so without delay.
He warned that failure to comply with the registration requirement could expose organisations to legal liabilities under the Nigeria Data Protection Act.
The Commission added that timely registration enhances public confidence in data processing activities while safeguarding the rights and freedoms of data subjects. It said the judgment is expected to strengthen the NDPC’s enforcement powers and reinforce accountability among organisations handling significant volumes of personal data.
