Point of Sale (PoS) agents across Nigeria will now be required to register with the Nigeria Data Protection Commission (NDPC) after a Federal High Court affirmed the Commission’s authority to classify them as Data Controllers and Processors of Major Importance (DCPMIs) under the Nigeria Data Protection Act (NDPA) 2023.
The ruling, delivered in Emmanuel Harunna v. Nigeria Data Protection Commission (FHC/L/CS/1116/2024), dismisses a legal challenge that sought to exempt PoS operators from the Commission’s registration framework. T
According to the NDPC, Justice F.N. Ogazi held that the Commission acted within its statutory powers in issuing the Guidance Notice on Registration and designating entities engaged in Ordinary High Level (OHL) Major Data Processing as Data Controllers and Processors of Major Importance.
The court found that the registration requirement aligns with the objectives of the Nigeria Data Protection Act by promoting accountability, transparency and responsible governance of personal data. It also ruled that registration enables regulators to identify organizations involved in significant data processing activities and effectively monitor compliance with data protection obligations.
Significantly, the court rejected arguments that compulsory registration infringes on Nigerians’ constitutional right to privacy. Instead, Justice Ogazi held that the framework strengthens privacy protections by bringing organizations handling sensitive personal information under regulatory supervision.
Calls For Urgent Registration
Following the judgment, the NDPC directed all affected entities that have not yet registered to do so without delay. In a statement signed by its Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, the Commission said National Commissioner and Chief Executive Officer Dr. Vincent Olatunji has ordered immediate compliance.
The Commission warned that failure to register could expose affected organizations to “serious legal liabilities” under the Nigeria Data Protection Act. It added that compliance not only fulfills statutory obligations but also enhances consumer confidence by demonstrating responsible handling of personal data.
The judgment also reinforces the legal supremacy of the Nigeria Data Protection Act in matters relating to personal data processing. The court affirmed that Section 65 of the Act overrides any inconsistent legislation dealing with data protection.
Implications For Digital Economy
The decision has broader implications for Nigeria’s digital economy. PoS agents routinely collect and process customers’ names, telephone numbers, Bank Verification Numbers (BVNs), account details, identity documents and transaction records. By bringing the sector formally within the NDPC’s regulatory framework, the Commission gains greater visibility into how this data is collected, stored, shared and protected.
The NDPC introduced its registration framework in 2024, requiring organizations considered to be of significant economic, social or national security importance to register as data controllers and processors. To reduce the compliance burden on smaller businesses, registration fees are tiered according to the level of data processing involved.
Under the framework, organizations classified as Ultra High Level (UHL) Major Data Processors pay N250,000, Extra High Level (EHL) entities pay N100,000, while those classified under the Ordinary High Level (OHL), the category applicable to many PoS operators pay N10,000.
For Nigeria’s rapidly expanding agency banking sector, the ruling provides long-awaited legal clarity. It confirms that PoS operators are not merely payment intermediaries but also custodians of sensitive personal data, making them subject to the same data governance standards increasingly expected across the country’s digital financial ecosystem.
