On July 28, 2026, the Federal High Court sitting at Lagos (Coram: F. N. Ogazi J) dismissed Suit – Emmanuel Harunna v. Nigeria Data Protection Commission (the “Suit”).1 In the Suit, the Applicant had sought, among others, a declaration that Point of Sale (POS) agents did not qualify as Data Controllers or Data Processors of Major Importance under prevailing Data Protection laws. The Federal High Court held that the Nigeria Data Protection Commission (NDPC) has powers to designate entities as Data Controllers and Data Processors of Major Importance (DCPMIs).
You would recall that the court in the case of Frank Ijege v. Nigeria Data Protection Commission2 held that the NDPC should designate entities not of major importance, and the NDPC had included this designation in the Nigeria Data Protection Act 2023 General Application and Implementation Directive, 2025 (NDP Act GAID) and the NDPC’s updated Guidance Notice on the Registration Of Data Controllers And Data Processors Of Major Importance And All Matters Connected Therewith, 2024. Given that the regulator has not designated POS operators, combined with this judgement, POS operators and other entities not so designated (as not of major importance) would need to ensure compliance with the registration requirements, to the extent that they have not been exempted and they qualify for registration.
On the basis of this decision, the NDPC has issued a public release in respect of this decision and has now directed that entities that qualify as DCPMI register with the NDPC, and that failure would attract serious legal liability.
Practical Implication and Conclusion
The Judgement confirms that the NDPC may designate entities as DCPMIs based on their processing activities, even when those activities are purely incidental to the processing activities of other data controllers and processors. The Judgement has also strengthened the NDPC’s overarching role of safeguarding privacy rights in Nigeria.
Agent banking and POS service providers and their principals must now ensure that they have the relevant compliance framework in place for the purpose of ensuring adherence to the DCPMI registration and other follow-on obligations.
For instance, where an entity registers as either Ultra-High Level (UHL) or Extra-High Level (EHL), there are specific requirements which would ordinarily apply to these entities, for instance, filing of compliance audits, and in the case of UHL, payment of processing fees in respect of their appointed processors every 12 months. Where entities register as Ordinary High Level (OHL), they would not typically be subject to filing of annual compliance audits; but they would need to register as OHL as required by the NDPC.
Critically, partner organisations with POS service providers must ensure the compliance of these entities in order to avoid consequential joint liability.
1Suit No. FHC/L/CS/1116/2024
2Suit No. FHC/KD/CS/34/2024
