The Federal High Court has upheld the authority of the Nigeria Data Protection Commission (NDPC) to require the registration of organisations classified as Data Controllers and Processors of Major Importance (DCPMIs), ruling that the commission acted within the powers granted to it under the Nigeria Data Protection Act, 2023.
The judgment was delivered in Lagos by Justice F.N. Ogazi in Suit No. FHC/L/CS/1116/2024, filed by Emmanuel Harunna against the NDPC.
Harunna had asked the court to declare that Point of Sale (POS) agents were not Data Controllers or Processors of Major Importance under the Act and sought an order preventing the commission from requiring their registration.
However, Justice Ogazi, after reviewing the NDPC’s Guidance Notice on Registration and relevant provisions of the Nigeria Data Protection Act, held that the commission had the legal authority to classify entities involved in significant data processing activities under the Major Data Processing, Ordinary High Level category.
On Tuesday, the court explained that the registration requirement was introduced to help the NDPC identify organisations that handle large amounts of personal information, monitor their compliance with data protection rules and ensure that citizens’ personal data are properly safeguarded.
“The Nigeria Data Protection Act was enacted to promote accountability, transparency and responsible data governance,” the court stated, adding that registration enables the commission to monitor entities engaged in significant data processing activities.
Justice Ogazi ruled that the registration framework does not violate citizens’ constitutional right to privacy, but instead provides a mechanism for strengthening the protection of personal data.
“Far from undermining the constitutional right to privacy, the registration framework is one of the statutory mechanisms designed to safeguard that very right,” the judgment stated.
The judge also affirmed that the NDPC’s Guidance Notice aligns with the constitutional objective of protecting the privacy and security of data subjects, adding that Section 65 of the Act gives the law priority over any conflicting legislation relating to personal data processing.
Reacting to the ruling, the NDPC’s Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, described the judgment as a major boost for data accountability and regulatory oversight in Nigeria.
The commission’s Chief Executive Officer, Vincent Olatunji, subsequently directed all Data Controllers and Processors of Major Importance that are yet to register to comply immediately, warning that failure to do so could result in legal consequences.
The NDPC said compliance with the registration framework would promote public trust, strengthen data protection practices and safeguard the rights of Nigerians whose personal information is processed by organisations.