Data commission issues fresh registration directive following court victory
July 28, 2026 5:51 pm
By Sami Tunji
The Nigeria Data Protection Commission has directed all Data Controllers and Data Processors of Major Importance yet to register with the commission to do so immediately following a Federal High Court judgment affirming its statutory powers to designate and register such entities.
The directive was contained in a statement issued on Tuesday by the Head of Legal, Enforcement and Regulations at the NDPC, Babatunde Bamigboye, who described the judgment as a major milestone for data accountability and regulatory oversight in Nigeria.
The commission said the ruling arose from a suit filed by Emmanuel Harunna against the NDPC in Emmanuel Harunna v. NDPC (FHC/L/CS/1116/2024), in which the applicant sought a declaration that Point of Sale agents were not Data Controllers or Processors of Major Importance under the Nigeria Data Protection Act and requested a perpetual injunction restraining the commission from registering them.
According to the statement, Justice F.N. Ogazi examined the commission’s Guidance Notice on Registration alongside Sections 5(d), 6(c), 44, 45 and 65 of the Nigeria Data Protection Act before concluding that the commission acted within its statutory powers in designating entities under the Major Data Processing – Ordinary High Level category as Data Controllers and Processors of Major Importance.
Quoting the judgment, the statement read, “The Nigeria Data Protection Act was enacted to promote accountability, transparency and responsible data governance. Registration enables the Respondent to identify entities engaged in significant data processing activities, monitor compliance.”
It added that the court held that, “Far from undermining the constitutional right to privacy, the registration framework is one of the statutory mechanisms designed to safeguard that very right by subjecting data controllers and data processors to effective regulatory oversight.”
The statement further quoted the court as saying, “Looking at the recitals of the Guidance Notice, there is every indication that the Guidance Notice is also aimed at protecting the privacy and security of data subjects, thus bringing the registration requirement of the Guidance Notice within the protective shield of Section 45 of the 1999 Constitution.”
According to the commission, the court also held that, “Remarkably, Section 63 of the Data Protection Act provides that the provisions of the Act shall prevail over any other law inconsistent with its provisions on matters relating to the processing of personal data.”
Reacting to the judgment, the commission described the decision as a significant boost to Nigeria’s data protection regime.
“The Commission appreciates the ground-breaking efforts of the court towards the advancement of the jurisprudence relating to data accountability in Nigeria, as eloquently demonstrated in this case,” the statement read.
Following the ruling, the NDPC said its National Commissioner and Chief Executive Officer, Vincent Olatunji, had directed every Data Controller and Processor of Major Importance that had yet to comply with the registration requirement to register without delay.
The commission warned that entities failing to comply with the registration requirement could face legal consequences.
“Failure to register creates serious legal liabilities under the law, while compliance with registration requirements builds public trust and safeguards the fundamental rights and freedoms of data subjects in Nigeria,” the statement added.
Sami Tunji is a Senior Business Correspondent at Punch Newspapers with about five years of experience in data-driven reporting. He covers finance, ICT, and broader macroeconomic issues, combining analytical insight with clear storytelling. Sami’s work reflects strong editorial judgment, professional development, and a commitment to accurate and informative business journalism.
All rights reserved. This material, and other digital content on this website, may not be reproduced, published, broadcast, rewritten or redistributed in whole or in part without prior express written permission from PUNCH.
Contact: [email protected]