Nigeria’s data protection watchdog now has PoS operators nationwide in its sights, after a Federal High Court dismissed a bid to exempt them from mandatory registration as Data Controllers and Processors of Major Importance (DCPMIs).
The judgment, delivered by Justice F.N. Ogazi in the case of Emmanuel Harunna v. Nigeria Data Protection Commission (Suit No. FHC/L/CS/1116/2024), has handed the Nigeria Data Protection Commission (NDPC) a significant legal victory and, industry watchers say, a green light to widen its enforcement net beyond banks, fintechs, and telecom giants to the small-scale agents who form the backbone of Nigeria’s cash-in, cash-out economy.
At the heart of the case was a straightforward but consequential question: do PoS agents, the ubiquitous roadside operators who process withdrawals, deposits, and transfers for a fee, qualify as “Data Controllers and Processors of Major Importance” under the Nigeria Data Protection Act (NDPA) 2023?
The applicant, Emmanuel Harunna, argued they do not. He asked the court to declare PoS agents exempt from the registration regime and sought a perpetual injunction barring the NDPC from compelling them to sign up.
It was, in effect, an attempt to carve an entire category of grassroots financial intermediaries out of Nigeria’s still-maturing data protection framework. The court disagreed on every count.
According to the NDPC’s statement, Justice Ogazi subjected the Commission’s Guidance Notice on Registration along with Sections 5(d), 6(c), 44, 45, and 65 of the NDPA to what the Commission described as thorough judicial scrutiny.
The judge held that the NDPC had acted squarely within its statutory powers when it designated entities falling under the “Major Data Processing – Ordinary High Level (OHL)” category as DCPMIs.
Justice Ogazi went further, tying the registration requirement directly to the underlying purpose of the Act: promoting accountability, transparency, and responsible governance of personal data.
Registration, the court found, gives the Commission a practical mechanism to identify organizations engaged in significant data processing and to track their compliance, something that would be impossible if large swathes of the payments ecosystem operated invisibly.
Perhaps the most pointed part of the ruling addressed the constitutional angle. The applicant’s case implicitly rested on the idea that mandatory registration infringes on privacy rights.
Justice Ogazi rejected that framing outright, holding that registration does not violate the constitutional right to privacy but instead strengthens it, by bringing data controllers and processors under structured regulatory oversight rather than leaving them to self-police.
The judgment also settled a broader legal question with implications well beyond PoS agents: the court affirmed that Section 65 of the NDPA takes precedence over any inconsistent legislation on data protection matters, reinforcing the Act’s status as Nigeria’s primary data governance instrument.
In a statement signed by Babatunde Bamigboye, NDPC’s head of legal, enforcement, and regulations, the regulator said its national commissioner and chief executive officer, Dr. Vincent Olatunji, has directed all data controllers and data processors of major importance that are yet to register with the commission to do so without delay.
The Commission’s language left little room for ambiguity about the consequences of inaction. Olatunji warned that failure to comply with the registration requirement could expose affected organizations to legal liabilities under the Nigeria Data Protection Act.
At the same time, the Commission struck a conciliatory note, framing compliance not merely as a legal obligation but as a trust-building exercise, arguing that it would strengthen public trust while protecting the fundamental rights and freedoms of data subjects in Nigeria.
The NDPC described the judgment as a major milestone for data accountability and regulatory oversight in Nigeria and reiterated its broader institutional mission of promoting accountability, transparency, and responsible personal data governance in line with the provisions of the Nigeria Data Protection Act, 2023.
The ruling lands at a moment when PoS agents have become one of the most consequential and least regulated nodes in Nigeria’s financial data chain.
Every withdrawal, transfer, or bill payment processed through a PoS terminal typically requires a customer to hand over a phone number, account number, sometimes a BVN, and occasionally a card that is inserted and a PIN entered in full public view.
Multiply that by the tens of millions of daily transactions PoS agents process nationwide, and the sheer volume of sensitive personal and financial data flowing through informal, often unregistered hands becomes clear.
From the NDPC’s perspective, that scale is precisely why PoS operators cannot sit outside the DCPMI framework: the “Major Importance” designation under the NDPA is triggered not by the size or sophistication of an operator, but by the volume and sensitivity of the data it processes a threshold PoS agents, collectively, clear many times over.
This is not the first time the boundaries of the NDPC’s registration regime have been tested in court, and the outcomes have not always gone the Commission’s way.
In an earlier case, Frank Ijege v. Nigeria Data Protection Commission, the Federal High Court in Kaduna ruled in favour of the applicant, nullifying certain provisions of the NDPC’s Guidance Notice on the Registration of Data Controllers and Data Processors of Major Importance, though it declined to grant an injunction halting registration altogether.
Earlier decisions had raised questions in legal circles about how much latitude the NDPC’s Guidance Notice really had. The Harunna ruling appears to reassert the commission’s authority more firmly, at least as it pertains to the specific question of PoS agents, even if the broader legal contest over the precise contours of the DCPMI framework may not yet be fully settled.
For PoS agents and the broader universe of DCPMIs still outside the registration net, the practical message from the NDPC is unambiguous: get registered now.
Industry compliance advisories note that the Commission has been moving from a “guidance-first” posture toward active enforcement in 2026, with administrative sanctions including monetary penalties on the table for entities that remain unregistered past communicated deadlines.
Applicants are generally expected to produce documentation including a Certificate of Incorporation from the Corporate Affairs Commission, constitutional documents, a Tax Identification Number and Tax Clearance Certificate, valid identification for directors, and an internal data protection policy, a compliance checklist arguably designed with corporate entities in mind, and one that could pose real friction for individual roadside PoS operators or small agent networks now expected to fall in line.
Beyond the immediate fate of PoS agents, the ruling carries weight for Nigeria’s broader data protection architecture.
By affirming the NDPC’s registration powers and the primacy of the NDPA over conflicting laws, the court has removed one of the more visible legal challenges to the Commission’s authority at a time when Nigeria is trying to position itself as a serious, rules-based digital economy.
For the millions of Nigerians who transact daily at PoS stands, often the only accessible financial services point in their neighborhood, the ruling is a reminder that the data trail left behind at those terminals is no longer a regulatory blind spot.
Whether PoS agents themselves, many of them small, informal operators, can realistically meet the compliance demands now being placed on them is likely to be the next chapter in this story.
WHAT YOU SHOULD KNOW
The Federal High Court has confirmed that PoS agents in Nigeria must register with the NDPC as data controllers/processors of major importance, and there’s no more room to dodge it.
The sheer volume of personal and financial data PoS agents handle daily puts them squarely under the law, registration doesn’t threaten privacy but protects it, and the NDPC is now shifting from warnings to active enforcement, with real legal penalties for those who stay unregistered.
If you operate a PoS business in Nigeria, the time to register is now, not later.
