The Nigeria Data Protection Commission (NDPC) has secured a landmark legal victory after the Federal High Court in Lagos affirmed its statutory authority to register Data Controllers and Processors of Major Importance (DCPMIs), reinforcing its regulatory oversight under the Nigeria Data Protection Act, 2023.

The Nigeria Data Protection Commission (NDPC) has recorded a significant legal victory after the Federal High Court in Lagos upheld its authority to register Data Controllers and Processors of Major Importance (DCPMIs).

Justice F.N. Ogazi, in a judgment delivered in the case of Emmanuel Harunna v. NDPC, dismissed a suit seeking to restrain the Commission from registering Point of Sale (POS) agents and other major data processors.

According to a statement signed by the NDPC’s Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, the court held that the Commission’s regulatory oversight strengthens data security and protects Nigerians’ constitutional right to privacy.

The court further ruled that the Nigeria Data Protection Act, 2023 takes precedence over any conflicting legislation relating to the processing of personal data.

Justice Ogazi held that the Act was enacted to promote accountability, transparency and responsible data governance, adding that the registration framework enables the Commission to identify entities engaged in significant data processing activities and effectively monitor compliance.

The court also noted that the registration requirement is designed to safeguard, rather than undermine, the constitutional right to privacy by subjecting data controllers and processors to appropriate regulatory oversight.

It further held that the NDPC’s Guidance Notice aligns with the constitutional protection of privacy under Section 45 of the 1999 Constitution and that Section 65 of the Nigeria Data Protection Act gives the legislation overriding effect in matters relating to personal data processing.

Following the judgment, the National Commissioner and Chief Executive Officer of the NDPC, Vincent Olatunji, directed all DCPMIs yet to register with the Commission to do so immediately or face statutory penalties.

Olatunji warned that failure to register exposes organisations to serious legal liabilities, while compliance enhances public trust and safeguards the fundamental rights and freedoms of data subjects in Nigeria.

The Commission described the judgment as a significant advancement in Nigeria’s data protection jurisprudence and a reaffirmation of its statutory mandate to enforce accountability in the country’s data governance ecosystem.