FG Orders PoS Operators to Register With NDPC as Court Upholds New Data Protection Rules
- Federal High Court has affirmed NDPC's authority over PoS operators in Nigeria
- PoS operators must register to ensure data protection compliance and accountability
- Failure to register may lead to sanctions under the Nigeria Data Protection Act
PAY ATTENTION: Find it fast with our new search feature at Legit.ng!
Pascal Oparada is a journalist with Legit.ng, covering technology, energy, stocks, investment, and the economy for over a decade.
Point of Sale (PoS) operators across Nigeria will now be required to register with the Nigeria Data Protection Commission (NDPC), following a Federal High Court's affirmation of the Commission's authority to regulate businesses that process customers' personal data.
The ruling marks a significant shift for the country's rapidly growing PoS industry, placing operators under stricter regulatory oversight as the Federal Government intensifies efforts to strengthen data privacy and protect millions of Nigerians who rely on agency banking services.
Source: Getty Images
Court backs NDPC's regulatory powers
The development follows the judgment in Emmanuel Harunna v. Nigeria Data Protection Commission (FHC/L/CS/1116/2024), in which the Federal High Court upheld the NDPC's powers under the Nigeria Data Protection Act (NDPA) 2023.
PAY ATTENTION: Mark Legit.ng as a preferred source, and our content will appear higher in your Google feed!
The court dismissed a lawsuit seeking to exempt PoS operators from mandatory registration, ruling that the Commission acted within its legal mandate by classifying eligible operators as Data Controllers and Processors of Major Importance (DCPMIs).
According to the judgment, businesses that collect, process or store substantial volumes of personal information fall within the Commission's regulatory scope and must comply with registration requirements.
Why PoS operators must register
The NDPC explained that PoS operators routinely handle sensitive customer information, including names, phone numbers, bank details and transaction records, making them subject to Nigeria's data protection framework, according to MSME Africa.
The Commission said compulsory registration is intended to promote accountability, transparency and responsible data governance while enabling regulators to monitor compliance with existing data privacy laws.
It also stressed that the requirement does not infringe on citizens' constitutional right to privacy. Instead, it strengthens that right by ensuring organisations entrusted with personal information operate under clear legal and regulatory standards.
NDPC issues immediate compliance directive
Following the court's decision, the National Commissioner and Chief Executive Officer of the NDPC, Dr Vincent Olatunji, directed all affected data controllers and processors that have not yet registered to complete the process without delay.
The Commission warned that businesses that ignore the directive could face sanctions and other legal consequences under the Nigeria Data Protection Act.
The move signals a tougher enforcement approach as the government seeks to improve compliance across industries handling sensitive customer data.
Registration categories and fees
Under the NDPC's 2024 Guidance Notice, organisations classified as Data Controllers and Processors of Major Importance are grouped into three categories based on the scale and impact of their data processing activities.
The registration fees are:
- Ultra High Level: ₦250,000
- Extra High Level: ₦100,000
- Ordinary High Level: ₦10,000
The applicable category depends on the volume of personal data processed and the organisation's significance to Nigeria's economy, society or national security.
What the decision means
The judgment reinforces the NDPC's authority to oversee organisations that collect, process or store personal information, including thousands of PoS businesses operating across Nigeria.
Source: Getty Images
Industry observers say the decision is expected to raise compliance standards within the agency banking sector while improving consumer confidence in the handling of personal and financial data.
For PoS operators, the message is clear: compliance with Nigeria's data protection laws is no longer optional, and those yet to register are expected to do so promptly to avoid regulatory penalties.
CAC issues deadline for PoS operators to register
Legit.ng earlier reported that the push to formalise Nigeria’s booming agent banking ecosystem entered a tense phase after the Corporate Affairs Commission inaugurated a dedicated centre for the bulk registration of POS operators.
The initiative came only one day after the dispute between the commission and agent networks had escalated, underscoring the pressure to bring thousands of informal players under regulatory oversight.
The registration centre was designed to accommodate long queues of operators seeking to incorporate their businesses, a requirement the commission said was essential for transparency and accountability in the expanding POS market.
Source: Legit.ng
