INTRODUCTION

Pursuant to powers conferred under the Nigeria Data Protection Act, 2023 (“NDPA”), the Nigeria Data Protection Commission (“NDPC”) issued a Guidance Notice on February 14, 2024 (“the Guidance Notice”), mandating the registration of Data Controllers and Data Processors of Major Importance (“DCPMIs”). The issuance of the Guidance Notice marked one of the most controversial regulatory developments, sparking widespread anxiety, legal pushback, and criticism over supposed ambiguities in the stipulated criteria for designation as DCPMIs.  Although the Guidance Notice was intended to operationalise the provisions of Sections 44 and 65 of the NDPA by prescribing categories of organisations required to register as DCPMIs, it generated unprecedented criticism from several stakeholders. On the whole, the Guidance Notice was not welcomed by all as an instrument of regulatory certainty, but was regarded as imposing burdensome compliance obligations on organisations that were never intended to be classified as DCPMIs and creating uncertainty regarding the scope of registration. Amidst these controversies, the legal issues were submitted to the Federal High Court, Lagos, for determination in the case of Emmanuel Haruna v. Nigeria Data Protection Commission[1] and other notable suits examined in this article.

This article examines the legal background of the Guidance Notice, the issues raised by stakeholders, litigations challenging the validity of the Guidance Notice, analysis of the decision of the court in Emmanuel Haruna v. Nigeria Data Protection Commission, its implications and other relevant suits and insights on proactive compliance measures.

The Registration Framework Under the Nigeria Data Protection Act 2023

The NDPA established a comprehensive regulatory framework for the protection of personal data in Nigeria. This framework is centred around the requirement that certain categories of data controllers and processors which have been classified as being “of major importance” must register with the NDPC.[2]

The requirement for registration is not introduced under the Guidance Notice. The need for accountability is a threshold principle of data protection enshrined under S.24(3) of the NDPA and thus it is not a creation of the Guidance Notice. The registration obligation is also entrenched in Section 44(1) of the NDPA, which requires DCPMIs to register with the Commission within six months after the commencement of the Act or upon becoming a data controller or processor of major importance.[3] Section 5(d) further complements this by imposing on the NDPC a statutory duty and discretion to register such entities.[4]

The Fundamental objectives of the NDPA by virtue of sections 1(1)(a) and 1(1)(c) of the Act include but not limited to safeguarding the fundamental rights and freedoms, and the interests of data subjects, as guaranteed under the Constitution of the Federal Republic of Nigeria, 1999 (As Amended) (“the Constitution”) and promoting data processing practices that safeguard the security of personal data and privacy of data subjects. It is in furtherance of these objectives that the NDPC is empowered to issue directives, guidelines and orders for the purposeful implementation of the NDPA. As stated in paragraph 1(2) of the Guidance Notice, the objective of the Guidance Notice is preventing significant harm to a data subject by placing certain data controllers and processors under specific obligations. To understand whether the criticisms referred to above are well founded, it is important to examine the scope of the powers delegated to the NDPC under section 65 of the NDPA. Section 65 empowers the NDPC to designate the types of processing activities that could be regarded as processing of personal data of significance to the economy, society or security of Nigeria. Under this same section, the NDPC is empowered to designate the type of processing activities to be regarded as of particular value to the economy or society. “Particular value” could be ascribed to attributes that preclude abuse of fiduciary relationships such as accountability, transparency, fairness, etc. Abuse of fiduciary relationships, if left unchecked and unregulated, could create mistrust between data subjects and data controllers and clog the wheel of commerce, governance, administration of justice, etc. It is therefore within the administrative responsibility of the NDPC to designate any processing activity carried out by any business or entity as having “particular value or significance to the economy, society or security of Nigeria.”        

It is important to note that those who are processing other people’s personal data also possess the capability to create substantial risk to data subjects. These risks are significant to the economy, society or security of Nigeria. The degree of risk or harm posed by the processing activities of such businesses or enterprises, if not properly regulated, is a relevant factor to be considered in the designation of DCPMIs.  In modern times, as a result of advancements in technology and the volume of digital transactions, it is no longer relevant that an organisation must be a tech giant operating at the level of Meta, Apple, Amazon, Google or Microsoft before its personal data processing activities can pose harms and risks to individuals. The processing activities of some small businesses pose significant risk of insurmountable magnitude, which could arise from data breaches, financial misappropriation, unauthorised disclosure of transaction details, fraud, financial losses, identity theft, reputational damage, violation of data subjects’ rights, etc.

To operationalise this provision, the NDPC issued the Guidance Notice on the Registration of DCPMIs on 14 February 2024.[5] The Guidance Notice sets the numerical threshold at 200 data subjects within six months and establishes a three-tier system for the classification of DCPMIs as follows: [6]

• The first tier, the Ultra High Level (UHL), covers entities such as commercial banks and telecommunications companies which process the personal data of over 5,000 data subjects;[7]

• Extra High Level (EHL), which covers agencies and entities processing between 1,000 and 5,000 data subjects within six months[8]; and

• Ordinary High Level (OHL), which covers entities that process the personal data of over 200 data subjects in the course of their business.[9] It was this framework and the validity of the Guidance Notice that the applicant in Emmanuel Haruna v Nigeria Data Protection Commission (supra) challenged before the Federal High Court.[10]

THE POSITION OF THE FEDERAL HIGH COURT IN EMMANUEL HARUNA V NIGERIA DATA PROTECTION COMMISSION[11]

The applicant, a Point of Sale (POS) agent operating in Lagos State, was onboarded by a finance company, Capricorn Limited (Baxi Limited), to provide POS services to customers. In summary, his case was based on two arguments. Firstly, that the Guidance Notice, requiring him to submit his personal information, which includes his name, National Identification Number (NIN), and contact details, to the NDPC for registration, violated his right to privacy under Section 37 of the Constitution. Second, that as a POS agent who merely hands an automated payment terminal device to customers and exercises no independent control over the data processed through it, is neither a data processor nor a DCPMI within the definition as provided by the NDPA. He further argued that as a POS agent, he was neither a data processor nor a DCPMI within the meaning of Section 65 of the Nigeria Data Protection Act 2023,[12] and that the NDPC, therefore, does not have the authority to compel his registration. The suit was framed as a fundamental rights enforcement claim.

The NDPC responded by stating that POS agents collect and handle personal data in the course of every transaction they facilitate, the registration requirement is a statutory obligation under the NDPA and not an invention of the Guidance Notice, and the requirement exists to protect the very individuals whose data the applicant handles.

The Court resolved all the substantive issues raised in the suit against the applicant.

THE REASONING OF THE COURT ON THE QUESTION OF PRIVACY

On 17 July 2026, the Federal High Court sitting in Lagos delivered a judgment dismissing the Applicant’s claims in their entirety. The Applicant had sought, among other reliefs, that the Guidance Notice, insofar as it required him to submit his personal data for the purpose of registering as a DCPMI, constituted an interference with his right to privacy as guaranteed under the Constitution.[13]

The Court, looking at the facts of the case before it, formulated two issues for determination as follows:

• Whether or not NDPC’s attempt to register the Applicant as a DCPMI constitutes an interference or likely interference with the Applicant’s right to privacy guaranteed by section 37 of the Constitution of the Federal Republic of Nigeria, 1999 (as amended)?

• Whether the Applicant – a Point of Sale (POS) agent can be lawfully designated by the NDPC as a DCPMI under the Nigeria Data Protection Act?

In resolving the issue of  whether the NDPC’s attempt to register the Applicant as a DCPMI constitutes an interference or likely interference with the Applicant’s right to privacy guaranteed by section 37 of the Constitution of the Federal Republic of Nigeria, 1999 (as amended), the Court acknowledged that although requiring a person to submit personal information to a public authority is capable of engaging the protection guaranteed under Section 37 of the Constitution, there is a need to balance between two competing constitutional interests, the individual’s right to privacy and the State’s legitimate authority to collect limited personal information for regulatory purposes.

It is well known that fundamental rights are not absolute and that Section 45 of the 1999 Constitution of the Federal Republic of Nigeria (as amended) permits derogations in certain circumstances. In determining this issue, the Court formulated a three-part test. An interference with the right to privacy is constitutionally permissible if: (a) it is authorised by law; (b) it pursues a legitimate public objective; and (c) it is reasonably necessary and proportionate to the objective sought to be achieved.

Applying the test in Emmanuel Haruna v Nigeria Data Protection Commission (supra), the Court found that all three tests were satisfied. In answering the first question, the Court stated that the registration requirement has a statutory foundation which is authorised by Sections 5(d), 6(c), 44, 45 and 65 of the NDPA[14] which empowers the NDPC to designate categories of DCPMI and to establish a registration framework for such entities, and thus, the Guidance Notice complained of by the Applicant was issued pursuant to the statutory powers of the NDPC. The Court further held that the NDPC has not exceeded or improperly exercised its authority conferred upon it by the NDPA. Thus, the Court held that the registration requirement was lawful and was backed up by the Constitution as a regulatory measure, and that the Applicant, by reason of the role he performs in the processing of personal data, falls within the scope of DCPMI as categorised by the NDPA and the Guidance Notice.

Answering the second question, the Court held that the information required from the Applicant for his Registration as a Data Controller or Processor is not sensitive personal data and serves the legitimate public objective of promoting accountability and protecting data subjects.

The Court noted that the Applicant has failed to show that the NDPC was asking for anything beyond what the registration process requires, or that the information being collected was excessive. The Court observed that the Applicant placed nothing before the court to suggest that the NDPC planned to share his personal details with unauthorised third parties, hold onto the data for purposes that have nothing to do with the NDPA, or handle it in any way that constitutes a breach of the law. Without any credible evidence pointing to any actual or likely misuse, the Court held that it cannot simply assume that a regulator whose very purpose is to protect personal data would breach the Constitution.

The Court’s Reasoning on the Criteria for Designation of DCPMIs

The Applicant’s second argument was that he is not a data processor at all. His reasoning had some instinctual appeal; he does not own the POS terminal, but owned by the financial institution, and he neither collects nor processes the customer’s personal data, but personally inputs customers’ banking details, and the actual electronic processing is carried out by the financial institution’s systems. In essence, he argued that he is merely a passive conduit; he hands the device over, the customer does the rest, and the bank’s infrastructure handles everything. By a careful reading of Section 65 of the NDPA, which defines who a data controller or processor is, the Applicant, as a POS Operator, is classified under the definition. Furthermore, the wide definition of ‘processing’ under the NDPA encapsulates even the most mundane aspects of data collection and transmission, whether or not by automated means.

Having considered the express provisions of Section 29 (1) and 65 of the NDPA, the court gave the literal interpretation of the words employed in the sections and stated that from the reading, the determination of whether a person is a data processor does not depend on whether they own the electronic infrastructure or whether they physically type in the customer’s details but what should be examined is the role performed by the person in the data processing chain as the POS operator provides the interface through which the transaction is initiated and completed. He performs acts on behalf of the financial institution whose payment infrastructure he utilises.

The Court also considered the provisions of Sections 44, 45 and 65 of the NDPA, and held that the NDPC is vested with the statutory authority to register and to designate categories of DCPMI having regard to the nature of their processing activities, the volume and the sensitivity of the personal data processed, amongst other considerations.

On this point, the Court examined the designation criteria set out in the Guidance Notice, which provides that a data controller or processor shall be deemed of major importance where, among other things, it processes the personal data of more than 200 data subjects within six months.[15]  The Court further held that POS agents, given the role they play in financial inclusion across the length and breadth of Nigeria by processing cash withdrawals, transfers, deposits, bill payments, and serving as intermediaries between financial institutions and members of the public, are of particular value and significance to the economy and society.

On the Applicant’s assertion that POS agents do not collect or process personal data, the Court found this position to be inconsistent with the facts before it. The Court held that POS agents are routinely involved in the processing of personal data. Their business entails collecting personal data such as customers’ names, account numbers, credit balances, and credit card details, and, on each daily transaction, a POS agent processes information to fulfil contractual obligations. The court found the Applicant’s claim that POS agents do not collect or process personal data to be inconsistent with factual reality.

On whether the NDPC exceeded its statutory authority in making this classification, the court stated that the court’s function is not to substitute its own assessment for that of a specialised regulator. Judicial intervention is only warranted where the exercise of statutory discretion is shown to be ultra vires the enabling Act, arbitrary, irrational, or otherwise inconsistent with the provisions of the Act.

The Applicant, in another suit he instituted against the Central Bank of Nigeria (“the CBN”),[16] unsuccessfully challenged the directive of the CBN requiring POS terminal operators to submit their personal information for registration with the Corporate Affairs Commission (“CAC”). In that case, the Court dismissed the Applicant’s challenge to the CBN’s directive requiring POS operators to register with the CAC, holding that the directive was a lawful exercise of the CBN’s statutory powers to protect the interest of the public and the financial sector from unscrupulous activities and that the applicant failed to establish any infringement of his constitutional right to privacy.

PRIOR JUDICIAL AUTHORITIES ON REGISTRATION OF DCPMIs

The judgments analysed above are significant as they come against the backdrop of an earlier challenge mounted back in 2024 in the case of Frank Ijege v. Nigeria Data Protection Commission,[17] in which the Federal High Court (Kaduna Division), invalidated certain provisions of the same Guidance Notice on the ground that they exceeded the NDPC’s statutory authority as it relates to legal practitioners who are not Data Controller or Processor. Together, these decisions are beginning to shape the jurisprudence on data privacy in Nigeria.

In Frank Ijege’s case, the Guidance Notice was challenged on multiple grounds. The Applicant had argued that the Guidance Notice violated his right to privacy under Section 37 of the Constitution, and that the Guidance Notice was confusing and required clarification; that, by virtue of Section 65 of the NDPA, not all individuals or entities are DCPMIs, and that several provisions of the Guidance Notice were ultra vires the NDPA and should be struck out. He also sought a declaration that the NDPC ought to provide clarity on entities exempted from the Guidance Notice and an order mandating the NDPC to prescribe entities that fall under the category of DCPMIs.

The court found merit in the application and held that paragraph 1(2) of the Guidance Notice, which classified entities in fiduciary relationships with data subjects as DCPMIs, was not within the contemplation of Section 65 of the NDPA. The court noted that the element of fiduciary relationship did not appear in Section 65 of the Act, and fiduciary relationships could merely be personal. The court held the same position for paragraphs 2(2)(f) and (h), 2(3)(g) and (i), 3(1)(e)(i), and 3(1)(e)(iv) of the Guidance Notice, declaring them ultra vires, null, and void. The court also declared that the Guidance Notice was confusing and required further clarification, ordered the NDPC to prescribe entities falling under the category of DCPMIs as contemplated by Section 48(3)(b) of the NDPA, and ordered the striking out of the offending paragraphs.

It is important to note that after the Ruling delivered in Frank Ijege’s case, the Guidance Notice was updated.[18] The updated version with the several modifications that have been introduced is now contained in Schedule 7 of the General Application and Implementation Directive (GAID) 2025, which was issued in 2025. 

LEGAL IMPLICATIONS

Interestingly, what has manifested on this novel jurisprudential issue of registration of DCPMIs may be seen as conflicting decisions of courts of coordinate jurisdiction. This could potentially create considerable uncertainty for businesses, legal practitioners, regulators and compliance professionals and raise important questions regarding judicial precedent, regulatory enforcement, compliance obligations and litigation strategy. The pronouncement of courts of appellate jurisdiction on the issue is yet to be seen. The Federal High Court is a single superior court of record established under section 249 of the Constitution, notwithstanding that it sits in different judicial divisions. Consequently, where conflicting decisions exist, neither judgment automatically supersedes the other.[19] Such conflicts can only be resolved by courts of appellate jurisdiction.

However, notwithstanding the conflicting nature of the judgments when reviewed on a broader scale, the judgment remains binding and enforceable on the specific parties to the suit and in relation to the specific issues submitted before the court for determination unless a valid order of stay of execution is issued or the judgment is overturned on appeal. Against this backdrop, it is important to examine some of the legal implications of the recent court decision in the case of Emmanuel Haruna v Nigeria Data Protection Commission (supra). First, registration under the NDPA is compulsory, not optional. The court did not treat the registration requirement as an option, but as a statutory obligation rooted in Sections 5(d), 44 and 65 of the NDPA. Any entity that meets the criteria set out in the Guidance Notice is legally required to register, and failure to do so is non-compliance with the law.

Second, the registration obligation applies to individuals, not just companies or organisations. The court, in Emmanuel Haruna v. Nigeria Data Protection Commission (supra), made a point of underlining the word “individual” in the Section 65 definition of a data controller and data processor. This was intentional because the Applicant had argued that as an individual roadside operator without an office or organisational structure, the registration framework was not designed for someone like him. The court disagreed with this contention of the Applicant.

Third, the argument that you do not own the technology used in the collection of data, and therefore you are not under the category of a DCPMI, does not hold. The court rejected it as inconsistent. The court’s approach means that the question is not whether you own the technology, whether you personally type in the customers’ details, or whether you consider yourself a data processor. The question is whether you play any role in the chain through which personal data moves. A POS agent who hands a terminal to a customer, receives instructions, facilitates the transmission of data, and completes a transaction is playing a role in that chain, and the court has said that is enough to qualify that agent as a data controller or a data processor.[20]

Lastly, the constitutional right to privacy cannot be used as a shield against regulatory registration. The fact that a regulatory authority requires information reasonably for a legitimate public objective does not offend Section 37 of the 1999 Constitution.

CONCLUSION

The conflicting Federal High Court decisions illustrate the challenges that arise when novel regulatory powers are tested before courts of coordinate jurisdiction. The decisions, however, remain binding on the parties before the courts unless execution of such decision is stayed by a court of competent jurisdiction or overturned on appeal. Data controllers and processors are advised to ensure compliance with the NDPA, the Guidance, and to adopt informed risk management measures. Decisions on whether to register should be on a risk-averse basis, adopting the criteria stipulated in the Guidance Notice and in accordance with the analysis of the Federal High Court in the case of Emmanuel Haruna v. Nigeria Data Protection Commission (supra).

The decision in Emmanuel Haruna v. Nigeria Data Protection Commission (supra) is a landmark decision in data protection regulation in Nigeria. For the first time, the court has upheld the NDPC’s Guidance Notice and affirmed the NDPC’s broad discretion to designate and register DCPMIs. The registration requirement by the NDPC is not an administrative overreach but a statutory obligation which serves a legitimate public purpose, and is now backed by judicial authority.

On the whole, this judgment demonstrates the judiciary’s reluctance to interfere with regulatory measures adopted in the public interest unless a concrete and legally cognisable violation of rights is established through credible evidence.

We are pleased to have represented the NDPC in the successful defence of this suit.