Nigeria: Privacy

The Federal High Court has affirmed the statutory powers of the Nigeria Data Protection Commission (NDPC) to register Data Controllers and Data Processors of Major Importance (DCPMIs) under the Nigeria Data Protection Act (NDPA), 2023. In a judgment delivered on 28 July 2026 by Honourable Justice F.N. Ogazi in Emmanuel Harunna v. Nigeria Data Protection Commission (FHC/L/CS/1116/2024), the court dismissed the applicant’s contention that Point of Sale (PoS) agents should not be classified as Data Controllers or Processors subject to the Commission’s registration regime.

The Nigeria Data Protection Commission's controversial Guidance Notice requiring registration of Data Controllers and Processors of Major Importance sparked legal challenges and widespread debate over regulatory authority, privacy rights, and compliance obligations. A landmark Federal High Court ruling has now clarified the scope and validity of these registration requirements, establishing binding precedent on who must register and under what circumstances.

Nigerian data protection law remains silent on what happens to personal data after death, creating a legal vacuum that has allowed the posthumous exposure of sensitive information belonging to prominent figures. This article examines whether privacy rights should extend beyond biological death, drawing on recent high-profile cases and proposing legislative reforms to protect the deceased and their surviving families.