Point of Sale (PoS) operators across Nigeria must now register with the Nigeria Data Protection Commission (NDPC) after the Federal High Court upheld the Commission's authority to regulate businesses that process customers' personal data. The landmark ruling, delivered in the case Emmanuel Harunna v. Nigeria Data Protection Commission (FHC/L/CS/1116/2024), affirms that the NDPC acted within its legal mandate under the Nigeria Data Protection Act (NDPA) 2023 by classifying eligible PoS operators as Data Controllers and Processors of Major Importance (DCPMIs).
Court Dismisses Challenge to NDPC Powers
The lawsuit sought to exempt PoS operators from mandatory registration, but the court dismissed it, ruling that businesses collecting, processing, or storing substantial volumes of personal information fall within the NDPC's regulatory scope. According to the judgment, operators handling sensitive customer data—including names, phone numbers, bank details, and transaction records—must comply with registration requirements to ensure accountability and transparency.
The NDPC emphasized that compulsory registration does not infringe on constitutional privacy rights but instead strengthens them by enforcing clear legal standards for data handling. The Commission warned that non-compliance could lead to sanctions under the NDPA.
Immediate Compliance Directive Issued
Following the court's decision, National Commissioner and CEO of NDPC, Dr. Vincent Olatunji, directed all affected data controllers and processors yet to register to complete the process without delay. The directive signals a tougher enforcement approach as the government seeks to improve compliance across industries handling sensitive customer data.
Industry observers note that the ruling is expected to raise compliance standards in the agency banking sector while boosting consumer confidence in personal and financial data protection. For PoS operators, the message is clear: adherence to Nigeria's data protection laws is no longer optional.
Registration Categories and Fees
Under the NDPC's 2024 Guidance Notice, DCPMIs are grouped into three categories based on data processing scale and impact: Ultra High Level (₦250,000), Extra High Level (₦100,000), and Ordinary High Level (₦10,000). The applicable fee depends on the volume of personal data processed and the organization's significance to Nigeria's economy, society, or national security.
This decision reinforces the NDPC's authority over thousands of PoS businesses nationwide. The Corporate Affairs Commission (CAC) recently inaugurated a dedicated centre for bulk registration of PoS operators, aiming to formalize the booming agent banking ecosystem and bring informal players under regulatory oversight.
