Point of Sale (PoS) agents across Nigeria are now legally required to register with the Nigeria Data Protection Commission (NDPC) after the Federal High Court affirmed the Commission’s authority to classify them as Data Controllers and Processors of Major Importance under the Nigeria Data Protection Act (NDPA) 2023.
The ruling followed a legal challenge seeking to exempt PoS operators from the registration requirement. However, the court dismissed the suit, holding that the NDPC acted within the powers granted to it by law when it designated PoS agents as entities subject to registration because of the volume and significance of personal data they process.
The judgment, delivered in the case of Emmanuel Harunna v. Nigeria Data Protection Commission (FHC/L/CS/1116/2024), provides legal backing for the Commission to strengthen enforcement of its data protection framework. Brandspur Brand News understands that the decision also empowers the NDPC to compel compliance and take enforcement action against affected operators that fail to register.
In its interpretation of the Nigeria Data Protection Act, the court held that the registration framework aligns with the law’s objective of promoting accountability, transparency and responsible handling of personal information. The court further ruled that requiring registration does not infringe on citizens’ constitutional right to privacy but instead enhances data protection by ensuring organisations processing sensitive personal information remain under regulatory oversight.
Following the judgment, the NDPC directed all affected Data Controllers and Processors of Major Importance that have yet to register to comply immediately. The Commission warned that failure to do so could expose defaulting entities to legal sanctions while stressing that compliance would improve public confidence in organisations handling personal data.
The ruling also reaffirmed the supremacy of the Nigeria Data Protection Act on matters relating to personal data processing, confirming that its provisions override any conflicting legislation in the area of data protection.
Under the NDPC’s registration framework introduced in 2024, organisations classified as Data Controllers and Processors of Major Importance are grouped into Ultra High Level, Extra High Level and Ordinary High Level categories, with registration fees determined according to the scale and nature of their data processing activities.
The latest judgment is expected to have significant implications for Nigeria’s rapidly expanding PoS ecosystem, where thousands of agents process customers’ personal and financial information daily. Industry stakeholders are now expected to strengthen compliance with data governance requirements as the NDPC intensifies enforcement of the country’s data protection regulations.
