BOI Launches $110m Debt Funds to Boost Nigeria’s Tech and Creative
Point of Sale (PoS) agents across Nigeria are now required to register with the Nigeria Data Protection Commission (NDPC) following a Federal High Court judgment affirming the Commission’s authority to regulate businesses that process personal data.
The development follows the court’s decision in Emmanuel Harunna v. Nigeria Data Protection Commission (FHC/L/CS/1116/2024), which upheld the NDPC’s power to classify PoS operators as Data Controllers and Processors of Major Importance (DCPMIs) under the Nigeria Data Protection Act (NDPA) 2023.
The court dismissed a suit seeking to exempt PoS agents from the registration requirement, ruling that the Commission acted within its statutory powers by requiring businesses that process significant volumes of personal data to register.
According to the NDPC, the registration framework promotes accountability, transparency and responsible data governance, while enabling the Commission to monitor compliance with Nigeria’s data protection laws.
The Commission also noted that the registration requirement does not violate the constitutional right to privacy but instead strengthens it by ensuring that organisations handling personal data operate under effective regulatory oversight.
Following the judgment, the National Commissioner and Chief Executive Officer of the NDPC, Dr. Vincent Olatunji, directed all affected data controllers and processors that have yet to register to do so immediately.
The Commission warned that businesses that fail to comply could face legal liabilities under the Nigeria Data Protection Act.
Under the NDPC’s 2024 Guidance Notice, organisations considered to be of significant importance to Nigeria’s economy, society or security are required to register as Data Controllers and Processors of Major Importance.
The Commission classifies major data processing into three categories: Ultra High Level, Extra High Level and Ordinary High Level, with registration fees of ₦250,000, ₦100,000 and ₦10,000 respectively.
The ruling reinforces the Nigeria Data Protection Commission’s authority to regulate organisations that collect, process or store personal data, including PoS businesses that handle customers’ financial and personal information.
