By 
Court Backs NDPC, Strengthens Nigeria’s Data Protection and Privacy Framework
The Federal High Court has reaffirmed the statutory authority of the Nigeria Data Protection Commission (NDPC) to regulate and register Data Controllers and Data Processors of Major Importance (DCPMIs), delivering a landmark judgment that strengthens Nigeria’s data protection regime and reinforces regulatory oversight of organisations handling significant volumes of personal data.
RELATED: NDPC in Q2 2026: From awareness to enforcement as Nigeria’s data economy takes centre stage
The judgment, delivered in Suit No. FHC/L/CS/1116/2024: Emmanuel Harunna v. Nigeria Data Protection Commission, dismissed attempts to curtail the Commission’s regulatory powers and confirmed that the NDPC acted within the provisions of the Nigeria Data Protection Act (NDPA), 2023.
The ruling is widely regarded as a major boost for Nigeria’s data governance framework, providing greater legal certainty for businesses, government agencies, financial institutions, fintech companies and other organisations that process personal data.
Court Upholds NDPC’s Statutory Mandate
In the suit, the applicant sought several reliefs, including a declaration that Point of Sale (PoS) agents should not be classified as Data Controllers or Data Processors of Major Importance under the Nigeria Data Protection Act.
The applicant also requested a perpetual injunction restraining the NDPC from registering PoS agents under its regulatory framework.
However, after an extensive judicial review of the Commission’s Guidance Notice on Registration and Sections 5(d), 6(c), 44, 45 and 65 of the Nigeria Data Protection Act, 2023, Justice F.N. Ogazi ruled in favour of the Commission.
The Court held that the NDPC acted within its statutory powers by designating organisations falling under the Major Data Processing – Ordinary High Level (OHL) category as Data Controllers and Data Processors of Major Importance (DCPMIs).
Registration Protects Privacy, Strengthens Accountability
In one of the most significant aspects of the judgment, the Court ruled that the registration framework supports—not undermines—the constitutional right to privacy.
Justice Ogazi held that the Nigeria Data Protection Act was enacted to promote:
- Accountability
- Transparency
- Responsible data governance
- Effective regulatory oversight
- Protection of personal data
According to the judgment, requiring organisations engaged in significant data processing activities to register enables the Commission to identify regulated entities, monitor compliance and ensure that personal information is processed responsibly.
The Court further observed that the Guidance Notice on Registration is designed to safeguard the privacy and security of Nigerians’ personal information and therefore falls within the constitutional protections provided under Section 45 of the 1999 Constitution.
Nigeria Data Protection Act Takes Precedence
The Court also clarified the supremacy of the Nigeria Data Protection Act in matters relating to personal data.
Citing Section 65 of the Act, Justice Ogazi ruled that the provisions of the NDPA prevail over any other law that conflicts with its provisions regarding the processing of personal data.
The decision provides greater legal certainty for Nigeria’s evolving digital economy by establishing the NDPA as the primary legal framework governing personal data protection across sectors.
NDPC Directs Immediate Registration of DCPMIs
Following the judgment, the National Commissioner and Chief Executive Officer of the NDPC, Dr. Vincent Olatunji, directed all organisations classified as Data Controllers and Data Processors of Major Importance that are yet to register with the Commission to do so without delay.
According to the Commission, failure to register exposes affected organisations to statutory sanctions and significant legal liabilities under the Nigeria Data Protection Act.
The Commission emphasized that registration is not merely a regulatory requirement but an essential mechanism for strengthening public confidence in Nigeria’s digital ecosystem and safeguarding the rights and freedoms of data subjects.
Why the Judgment Matters
The ruling has far-reaching implications for Nigeria’s rapidly expanding digital economy, particularly as organisations increasingly rely on data-driven services.
For Businesses and Digital Platforms
Companies processing significant volumes of customer information—including fintechs, banks, telecommunications companies, healthcare providers, e-commerce platforms, insurance firms, educational institutions and digital service providers—must ensure compliance with NDPC registration requirements and broader data protection obligations.
The judgment reinforces the need for organisations to strengthen their governance structures, privacy policies and compliance programmes.
For Point-of-Sale (PoS) Operators and Financial Service Providers
The case provides legal clarity regarding the NDPC’s authority to regulate entities engaged in substantial personal data processing, including categories such as PoS operators where applicable under the Commission’s regulatory framework.
Financial service providers handling sensitive customer information are expected to maintain robust data governance systems consistent with the NDPA.
For Nigerian Consumers
For millions of Nigerians whose personal information is collected daily across banking, telecommunications, healthcare, digital commerce and government platforms, the ruling provides stronger legal safeguards.
Greater regulatory oversight is expected to improve accountability among organisations handling personal data while reducing risks associated with misuse, unauthorized disclosure and poor data management.
For Nigeria’s Digital Economy
Industry stakeholders say the judgment strengthens investor confidence by reinforcing regulatory certainty around data governance.
As Nigeria continues expanding digital financial services, artificial intelligence, cloud computing and e-government platforms, effective data protection remains critical to sustaining innovation while protecting citizens’ privacy rights.
The ruling also aligns Nigeria with international best practices on data governance, accountability and responsible digital transformation.
Strengthening Nigeria’s Data Protection Jurisprudence
The NDPC welcomed the judgment as an important milestone in the evolution of Nigeria’s data protection jurisprudence.
According to the Commission, the decision advances legal clarity regarding regulatory accountability while affirming the importance of robust oversight in protecting personal data.
The Commission reiterated that compliance with registration requirements not only fulfils statutory obligations but also builds public trust, enhances corporate accountability and strengthens Nigeria’s digital governance framework.
A Landmark Victory for Data Governance
The Federal High Court’s decision marks another significant milestone in Nigeria’s implementation of the Nigeria Data Protection Act, 2023, reinforcing the NDPC’s role as the country’s primary data protection regulator.
With the Court affirming the Commission’s statutory powers, organisations processing significant volumes of personal data are now expected to accelerate compliance efforts, while consumers stand to benefit from stronger regulatory oversight, enhanced privacy protection and improved accountability across Nigeria’s increasingly digital economy.
