Court affirms NDPC’s powers to register major data processors

By Precious Mark

The Federal High Court in Lagos has affirmed the powers of the Nigeria Data Protection Commission (NDPC) to designate and register Data Controllers and Processors of Major Importance (DCPMIs) across the country.

The decision follows a judgment delivered by Honourable Justice F.N. Ogazi in the suit Emmanuel Harunna v. NDPC (FHC/L/CS/1116/2024), where the applicant sought an injunction to restrain the regulatory body from registering Point of Sale (POS) agents, contending that they do not qualify as major data processors under the law.

Dismissing the application, Justice Ogazi subjected the NDPC’s Guidance Notice on Registration alongside key provisions of the Nigeria Data Protection Act (NDPA) to judicial scrutiny, ruling that the Commission acted strictly within its legal mandates.

The court held that designating entities under the Major Data Processing – Ordinary High Level (OHL) category aligns with statutory efforts to enforce data accountability and protect citizens’ fundamental rights.

“The Nigeria Data Protection Act was enacted to promote accountability, transparency and responsible data governance,” Justice Ogazi held.

“Registration enables the Respondent to identify entities engaged in significant data processing activities, monitor compliance… far from undermining the constitutional right to privacy, the registration framework is one of the statutory mechanism designed to safeguard that very right by subjecting data controllers and data processors to effective regulatory oversight,” the judge added.

The court further noted that the registration framework falls under the protective scope of Section 45 of the 1999 Constitution, emphasizing that Section 63 of the NDPA establishes the Act’s supremacy over conflicting laws regarding personal data processing.

“Looking at the recitals of the Guidance Notice, there is every indication that the Guidance Notice is also aimed at protecting the privacy and security of data subjects,” the court noted.

Reacting to the judgment in a statement issued on Tuesday, July 28, 2026, by the Head of Legal, Enforcement & Regulations, Babatunde Bamigboye, the Commission commended the judiciary for advancing data protection jurisprudence in Nigeria.

Following the victory, the National Commissioner and Chief Executive Officer of the NDPC, Dr. Vincent Olatunji, directed all unregistered DCPMIs nationwide to comply with registration requirements immediately.

“Failure to register creates serious legal liabilities under the law; while compliance with registration requirements builds public trust and safeguards fundamental rights and freedoms of data subjects in Nigeria,” the statement warned.