PoS Agents Must Register with NDPC, Court Rules

Point of Sale (PoS) agents in Nigeria will now be required to register with the Nigeria Data Protection Commission (NDPC) as they fall within the category of Data Controllers and Processors of Major Importance (DCPMIs).

Point of Sale (PoS) agents in Nigeria will now be required to register with the Nigeria Data Protection Commission (NDPC) as they fall within the category of Data Controllers and Processors of Major Importance (DCPMIs).

This follows a landmark Federal High Court ruling that upheld the Commission’s regulatory powers to register them.

The NDPC disclosed this in a statement on Tuesday, noting that the judgment delivered by the Federal High Court in Emmanuel Harunna v. Nigeria Data Protection Commission (FHC/L/CS/1116/2024) dismissed a legal challenge seeking to exempt PoS agents from the registration requirement under the Nigeria Data Protection Act (NDPA) 2023.

What they are saying

According to the data protection watchdog, the ruling also paves the way for the NDPC to intensify enforcement of its registration framework, warning that affected entities that fail to comply could face legal liabilities.

The applicant had asked the court to declare that Point of Sale agents are not Data Controllers or Processors of Major Importance under the Nigeria Data Protection Act and sought a perpetual injunction preventing the NDPC from requiring their registration.

• “His Lordship, Honourable Justice F.N. Ogazi, subjected the Guidance Notice on Registration and Sections 5(d) 6(c), 44, 45 and 65 of the Nigeria Data Protection Act to a thorough judicial analysis and gave judgment to the effect that the Commission acted within its statutory powers in designating persons or entities within the category of Major Data Processing – Ordinary High Level (OHL) as Data Controllers and Processors of Major Importance (DCPMIs),” NDPC stated.

According to the judgment, the registration framework is consistent with the objectives of the Act, which seeks to promote accountability, transparency and responsible governance of personal data.

The court further held that registration enables the Commission to identify organisations engaged in significant data processing activities and monitor their compliance with data protection obligations.

Justice Ogazi also ruled that the requirement does not violate the constitutional right to privacy. Rather, it strengthens that right by bringing data controllers and processors under effective regulatory oversight.

NDPC orders immediate compliance

Following the judgment, the NDPC, in the statement signed by its Head of Legal, Enforcement & Regulations, Babatunde Bamigboye Esq., said its National Commissioner and Chief Executive Officer, Dr Vincent Olatunji, has directed all DCPMIs that have yet to register with the Commission to do so immediately.

The Commission warned that failure to register creates “serious legal liabilities” under the law, adding that compliance helps build public trust while protecting the fundamental rights and freedoms of data subjects.

The judgment also reinforces the supremacy of the Nigeria Data Protection Act in matters relating to personal data processing, with the court affirming that Section 65 of the Act prevails over any inconsistent law on data protection matters.

What you should know

The NDPC had in 2024 issued a Guidance Notice detailing the categories of companies mandated to register with the Commission as data controllers and processors in the country.

• According to the Commission, organizations that are of “particular value or significance to the economy, society or security of Nigeria” are designated as data controllers and processors of major importance.

To foster ease of doing business, particularly for small organizations involved in potentially high-risk data processing, the Commission said it varies the payable fees according to the level of Major Data Processing (MDP) involved.

Major Data Processing (MDP) is classified into 3 levels, namely: Ultra High Level (UHL), Extra High Level (EHL) and Ordinary High Level (OHL) of Major Data Processing. The fees payable are N250,000, N100,000 and N10,000 respectively.