The Nigeria Data Protection Commission has secured a Federal High Court victory affirming its authority to register Point of Sale agents and other major data processors under the Nigeria Data Protection Act 2023, dismissing a legal challenge and paving the way for strict regulatory enforcement and potential statutory penalties.
Data accountability in Nigeria entered a new phase following a Federal High Court judgment that confirmed the regulatory authority of the Nigeria Data Protection Commission over key data processors. Hon. Justice F.N. Ogazi delivered the ruling in the case of Emmanuel Harunna v. NDPC, dismissing a legal challenge that sought to exempt Point of Sale agents and other major data handlers from mandatory registration obligations.
Court Rejects Exemption Bid and Upholds Statutory Authority
The applicant had petitioned the court for a declaration that Point of Sale agents do not qualify as Data Controllers or Processors of Major Importance under the governing statute, while also seeking a perpetual injunction to restrain the Commission from enforcing registration requirements. Instead, the court subjected the Guidance Notice on Registration and foundational provisions of the law to close judicial analysis.
Justice Ogazi ruled that the regulator acted fully within its statutory mandate when designating entities involved in significant personal data processing as Data Controllers and Processors of Major Importance. The ruling directly addresses the legal standing of ordinary high-level data processing operations across the country, affirming that regulatory oversight remains fully enforceable.
“The Nigeria Data Protection Act was enacted to promote accountability, transparency and responsible data governance, Registration enables the Respondent to identify entities engaged in significant data processing activities, monitor compliance, far from undermining the constitutional right to privacy, the registration framework is one of the statutory mechanism designed to safeguard that very right by subjecting data controllers and data processors to effective regulatory oversight.”
Hon. Justice F.N. Ogazi, Federal High Court, Lagos
Balancing Privacy Rights and Statutory Supremacy
A core element of the legal challenge involved the constitutional right to privacy. The applicant argued that mandatory registration infringed upon fundamental freedoms. The court rejected that interpretation, finding that the regulatory framework actively reinforces constitutional safeguards rather than eroding them.
The court noted that the recitals within the Guidance Notice align with the objective of protecting data subjects. Consequently, the registration mandate falls safely under the protective shield of section 45 of the 1999 Constitution. Furthermore, the bench underscored the pre-eminence of the primary data legislation over conflicting statutes.
Compliance Tiers and Immediate Enforcement Directives
Following the judgment, National Commissioner and Chief Executive Officer FRCN HQ directed all unregistered Data Controllers and Processors of Major Importance to complete their registration immediately. The regulatory body warned that failing to comply introduces serious legal liabilities
under the law.
What Lies Ahead for Data Processing Entities
With the judicial hurdles cleared, the agency is positioned to intensify enforcement actions against commercial networks, financial intermediaries, and technology-driven service providers operating without proper credentials. Organizations that collect personal information face a strict regulatory environment where processing data without registration constitutes a statutory offense.
