Federal High Court Upholds NDPC’s Authority Over POS Agents

The Federal High Court sitting in Lagos, has delivered its judgment in Emmanuel Harunna v Nigeria Data Protection Commission.¹ The applicant instituted an action against the Nigeria Data Protection Commission (NDPC), arguing that the Commission wrongly classified him as a Data Controller and Data Processor of Major Importance under the Guidance Notice.²

The applicant sought several reliefs from the court; among them was a declaration that a Point of Sale (POS) agent is not a Data Controller and Data Processor of Major Importance under the NDPA.³ The applicant also sought a perpetual injunction restraining NDPC from requiring the POS agents to register as Data Controllers and Data Processors of Major Importance.

In his judgment, Justice F. N. Ogazi dismissed the applicant’s claims that the NDPC’s registration requirement for POS agents infringes on their constitutional rights. The court held that the NDPC has the legal authority under the NDPA to determine the categories of organizations that qualify as Data Controllers and Data Processors of Major Importance pursuant to the provisions of the NDPA and the Guidance Notice.⁴

1.              REINFORCING THE NIGERIA DATA PROTECTION ACT’S PRINCIPLES

This decision reinforces core principles of the NDPA:

1.1 That organizations meeting the applicable registration threshold must be accountable to the regulator. Mandatory registration enables the NDPC to identify POS agents, monitor their compliance with the NDPA, conduct audits and investigations, and take appropriate enforcement action where necessary.

1.2 That the NDPC has the statutory authority to enforce the NDPA against POS agents through regulatory measures, including compliance audits, investigations, and other enforcement actions provided under the Act.

1.3 That NDPC’s oversight function promotes responsible processing of personal data by ensuring that POS agents adopt processing practices that are fair, lawful and

2.              IMPORTANT IMPLICATIONS FOR POS AGENTS

One key implication of the judgment is that POS agents who meet the applicable thresholds prescribed under the Guidance Notice on the Registration of Data Controllers and Data Processors of Major Importance and the GAID are required to register with the Nigeria Data Protection Commission (NDPC) as Data Controllers and/or Data Processors of Major Importance, as applicable. Registration subjects such entities to the NDPC's regulatory oversight, including compliance monitoring, audits, and enforcement measures under the Nigeria Data Protection Act (NDPA) 2023.

Failure to register where required, or failure to comply with the obligations imposed under the NDPA and the GAID, may expose the organisation to administrative sanctions, including penalties and other enforcement measures, in accordance with the provisions of the Act.

3.              KEY TAKEAWAYS

• The judgment affirms the NDPC's statutory authority under the NDPA to classify eligible POS agents as Data Controllers and Data Processors of Major Importance, in accordance with the applicable thresholds and criteria set out in the Guidance Notice on the Registration of Data Controllers and Data Processors of Major Importance and the GAID.
• The judgment confirms that POS agents who meet the applicable registration thresholds are required to register with the NDPC and that failure to do so may attract administrative sanctions and other enforcement measures under the
• The court confirms that registration facilitates regulatory oversight by the NDPC and supports compliance with the obligations imposed under the NDPA and subsidiary regulatory instruments.
• The decision reinforces NDPA’s principles of accountability, transparency and responsible data processing while affirming the NDPC's mandate to safeguard the privacy and data protection rights of data subjects.
• The judgment affirms the primacy of the NDPA in regulating personal data processing and protecting rights of data subjects notwithstanding any inconsistent provisions in other laws.

Footnotes

^{1        FHC/L/CS/1116/2024 (Unreported).}

^{2        Nigeria Data Protection Commission, “Court Backs NDPC’S Power on Registration of DCPMIs: Victory for Data Accountability in Nigeria” (Press Release, 28 July, 2026) available at}

^{(https://www.linkedin.com/posts/press-release-court-backs-ndpcs-power-on-ugcPost-7487798353855029248-) accessed on 28 July, 2026.}

^{3        See, Nigeria Data Protection Act, 2023.}

^{4        Nigeria Data Protection Commission, “Guidance Notice on the Registration of Data Controllers and Data Processors of Major Importance and All Matters Connected Therewith” available at}

^{(https://ndpc.gov.ng/wp-content/uploads/2025/07/Updated-Guidance-Notice-on-Registration-2024.pdf) accessed on 28 July, 2026.}

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.