In a bid to ensure full compliance with the Nigeria Data Protection Act, 2024 (NDP Act), the Nigeria Data Protection Commission (NDPC) has extended the deadline for the registration of Data Controllers and Data Processors of Major Importance (DCPMIs). The new deadline, approved by the National Commissioner/CEO, Dr. Vincent Olatunji, is now set for October 31, 2024.
This move provides more time for organizations categorized as DCPMIs to register without facing penalties. However, the NDPC has also imposed a critical restriction: beginning from October 15, 2024, DCPMIs will only be allowed to engage agents and contractors who are registered with the Commission. This decision aligns with sections 24(3), 29(1)(a), and 44 of the NDP Act, which mandates strict adherence to data protection regulations.
Section 29(1)(a) of the Act emphasizes that data controllers must ensure any data processor they engage complies with the obligations set out in the Act. Specifically, it states that:
> “Where a data controller engages the services of a data processor, or a data processor engages the services of another data processor, the data controller or data processor engaging another shall ensure that the engaged data processor complies with the principles and obligations set out in this Act as applicable to the data controller.”
In addition, Section 65 of the Act defines a data processor as:
> “An individual, private entity, public authority, or any other body who processes personal data on behalf of or at the direction of a data controller or another data processor.”
With this development, the NDPC is calling on all DCPMIs to ensure that any third parties processing personal data on their behalf are fully compliant and registered. Failure to comply with these requirements will be regarded as a violation of the NDP Act, subjecting organizations to potential sanctions.
The Commission stressed that engaging agents or contractors who do not meet the legal obligations applicable to data controllers or processors is not only a breach of the law but also undermines the integrity of data privacy in Nigeria.
The extension of the deadline is seen as part of NDPC’s efforts to foster accountability and encourage adherence to data protection standards in the country.
Reported by:
Anthony Emeka Nwosu
Tech & Biz News