The Federal High Court has reaffirmed the statutory powers of the Nigeria Data Protection Commission (NDPC) to register Data Controllers and Data Processors of Major Importance (DCPMIs), in what is being described as a landmark victory for data accountability, regulatory oversight, and the protection of personal information in Nigeria.
The judgment, delivered by Honourable Justice F.N. Ogazi in the case of Emmanuel Harunna v. Nigeria Data Protection Commission (FHC/L/CS/1116/2024), reinforces the Commission’s authority under the Nigeria Data Protection Act (NDPA), 2023, to regulate organizations and entities that process significant volumes of personal data.
The applicant had sought a declaration that Point of Sale (PoS) agents should not be classified as Data Controllers or Data Processors of Major Importance and requested a perpetual injunction restraining the NDPC from enforcing their registration.
After a detailed judicial review of the NDPC’s Guidance Notice on Registration and relevant provisions of the Nigeria Data Protection Act, 2023—including Sections 5(d), 6(c), 44, 45, and 65—the court held that the Commission acted squarely within its statutory mandate in designating entities under the Ordinary High Level (OHL) category as DCPMIs.
In its judgment, the court emphasized that the Nigeria Data Protection Act was enacted to promote accountability, transparency, and responsible data governance across the country. The court further held that the registration framework enables the NDPC to identify organizations engaged in significant data processing, monitor compliance with data protection obligations, and strengthen regulatory oversight.
Significantly, the court ruled that the registration requirement does not violate the constitutional right to privacy. Rather, it serves as a critical mechanism for safeguarding that right by ensuring that organizations processing sensitive personal data operate within a regulated framework. The judgment also affirmed that the NDPC’s Guidance Notice is consistent with Section 45 of the 1999 Constitution and that Section 65 of the Nigeria Data Protection Act gives the Act supremacy over any conflicting laws relating to the processing of personal data.
The ruling represents a major milestone in the evolution of data protection jurisprudence in Nigeria and provides much-needed legal certainty for businesses, financial institutions, digital service providers, fintech companies, healthcare organizations, educational institutions, and other entities that process large volumes of personal information.
Following the judgment, the National Commissioner and Chief Executive Officer of the NDPC, Dr. Vincent Olatunji, directed all Data Controllers and Data Processors of Major Importance that are yet to register with the Commission to do so without delay.
According to the Commission, failure to register may expose defaulting organizations to significant legal and regulatory consequences under the Nigeria Data Protection Act. Conversely, compliance demonstrates a commitment to responsible data governance, enhances consumer confidence, strengthens cybersecurity governance, and protects the fundamental privacy rights of millions of Nigerians.
What This Means for Data Protection in Nigeria
The judgment is expected to have far-reaching implications for Nigeria’s digital economy. It reinforces the NDPC’s regulatory authority and sends a strong signal that organizations handling personal data must comply with established data protection standards.
As Nigeria continues to embrace digital banking, fintech, e-commerce, artificial intelligence, healthcare digitization, and government digital services, effective oversight of major data processors has become increasingly important. The court’s decision strengthens Nigeria’s data protection ecosystem by ensuring that organizations entrusted with personal data remain accountable, transparent, and subject to regulatory supervision.
Industry experts believe the ruling will improve public confidence in how personal data is collected, stored, processed, and shared while aligning Nigeria more closely with global best practices in privacy and data governance. It also underscores that compliance with the Nigeria Data Protection Act is not optional but a legal obligation for organizations whose data processing activities fall within the categories prescribed by the NDPC.
The judgment is widely regarded as a significant boost to Nigeria’s efforts to build a secure, trustworthy, and globally competitive digital economy founded on strong data protection principles.
