Federal High Court Affirms NDPC’s Authority to Register Data Controllers and Processors of Major Importance

The Nigeria Data Protection Commission has won a court battle that tested the legal basis of its power to compel registration of Data Controllers and Processors of Major Importance (DCPMIs), in a ruling that data governance watchers are calling a defining moment for enforcement in the country.

The case, Emmanuel Harunna v. NDPC (FHC/L/CS/1116/2024), was brought before the Federal High Court by an applicant seeking, among other reliefs, a declaration that Point of Sale agents do not qualify as Data Controllers or Processors of Major Importance under the Nigeria Data Protection Act. The applicant also asked the court for a perpetual injunction stopping the Commission from registering POS agents under that classification.

Justice F.N. Ogazi examined the Commission’s Guidance Notice on Registration alongside sections 5(d), 6(c), 44, 45 and 65 of the Nigeria Data Protection Act, 2023, before ruling that the Commission had acted squarely within its statutory mandate in classifying entities under the Major Data Processing – Ordinary High Level (OHL) category as DCPMIs.

In the judgment, the court linked the registration requirement directly to the underlying purpose of the Act, noting that the law exists to promote accountability, transparency and responsible handling of personal data. Registration, the court found, gives the Commission a way to identify organisations carrying out significant data processing and to track whether they are meeting their obligations. Rather than eroding the constitutional right to privacy, the court reasoned that the registration framework is one of the very tools designed to protect that right, by placing data controllers and processors under active regulatory watch.

The court went further, tying the Guidance Notice’s objectives to constitutional protection. Looking at the recitals of the notice, the judgment held that its underlying aim of safeguarding the privacy and security of data subjects brings it within the protective scope of section 45 of the 1999 Constitution. The ruling also drew attention to section 65 of the Data Protection Act, which gives the Act’s provisions precedence over any other law that conflicts with it on matters of personal data processing.

For the NDPC, the outcome is being read as confirmation that its registration regime rests on solid legal footing, at a time when the Commission has been pushing to bring more organisations formally into its regulatory net. In reaction to the judgment, the Commission described it as a step forward for the development of data accountability jurisprudence in Nigeria.

Following the ruling, the NDPC’s National Commissioner and Chief Executive Officer, Dr Vincent Olatunji, has directed all entities classified as DCPMIs that have not yet registered with the Commission to do so without further delay. The Commission has warned that failure to register exposes organisations to legal liability under the Act, while registering signals compliance that helps build public trust and protects the rights of data subjects across Nigeria.

The judgment adds legal weight to an enforcement push the NDPC has maintained since the Guidance Notice on Registration took effect, and it is likely to shape how the Commission approaches similar disputes going forward, particularly as it continues to expand the list of sectors and entities required to register as DCPMIs.