The Federal High Court has upheld the Nigeria Data Protection Commission’s (NDPC) legal authority to require the registration of Data Controllers and Data Processors of Major Importance, reinforcing the country’s data protection framework and regulatory oversight of organisations handling significant volumes of personal information.
Justice F.N. Ogazi delivered the ruling in Emmanuel Harunna v. Nigeria Data Protection Commission (FHC/L/CS/1116/2024), according to a statement issued by the NDPC’s Head of Legal, Enforcement and Regulations, Babatunde Bamigboye.
The applicant had asked the court to declare that Point of Sale (POS) agents do not qualify as Data Controllers or Data Processors of Major Importance under the Nigeria Data Protection Act (NDPA). He also sought a perpetual injunction preventing the Commission from requiring such agents to register under the framework.
However, after examining Sections 5(d), 6(c), 44, 45 and 65 of the NDPA, along with the NDPC’s Guidance Notice on Registration, the court dismissed the suit.
Justice Ogazi ruled that the Commission acted within its statutory powers by designating entities engaged in Major Data Processing – Ordinary High Level (OHL) as Data Controllers and Data Processors of Major Importance.
The judge said the Nigeria Data Protection Act was enacted to promote accountability, transparency and responsible data governance. He added that the registration framework enables the Commission to identify organisations carrying out significant data processing, monitor compliance and strengthen regulatory oversight.
The court also held that the registration requirement does not violate the constitutional right to privacy. Instead, it serves as a statutory mechanism to protect that right through effective regulatory supervision.
Furthermore, the judgment found that the objectives of the NDPC’s Guidance Notice are consistent with constitutional protections for privacy and the security of personal data under Section 45 of Nigeria’s 1999 Constitution.
Justice Ogazi also emphasised that Section 63 of the Nigeria Data Protection Act gives the legislation overriding effect over any inconsistent law relating to the processing of personal data.
Reacting to the decision, the NDPC described the judgment as a landmark development for data protection jurisprudence in Nigeria.
Following the ruling, the Commission’s National Commissioner and Chief Executive Officer, Dr Vincent Olatunji, directed all Data Controllers and Data Processors of Major Importance that have not yet registered with the NDPC to do so without delay.
He warned that organisations failing to comply with the registration requirement could face legal liabilities under the Nigeria Data Protection Act.
