Registration of Data Controllers and Processors in Nigeria: A New Era of Data Protection Compliance

Contributor: Betseabasi asuquo

Introduction

Safeguarding personal data has, in the last few years, emerged a pivotal concern for individuals, businesses, and regulatory authorities alike.^[1] With the unprecedented increase in the collection, storage, and processing of data, prioritizing privacy, security, and compliance has become an essential element of corporate responsibility.^[2] Acknowledging this imperative, the Nigerian government introduced the Nigeria Data Protection Act (NDPA) 2023, which lays down a legal framework to govern the management of personal data across diverse sectors.

In pursuit of its responsibilities outlined in the Act, the Nigeria Data Protection Commission (NDPC) released a Guidance Notice NDPC/HQ/GN/VOL.02/24 concerning the registration of data controllers and data processors of significant importance.^[3] This directive sought to ensure that organizations engaged in the processing of substantial volumes of personal data or dealing with sensitive information comply with rigorous regulatory standards.^[4] The Notice defines three classifications for data controllers and processors based on the scale, importance, and sensitivity of the personal data they handle: Major Data Processing – Ultra High Level (MDP-UHL), Major Data Processing – Extra High Level (MDP-EHL), and Major Data Processing – Ordinary High Level (MDP-OHL).^[5] Entities identified within these categories are mandated to register with the NDPC and non-compliance may result in regulatory sanctions. This initiative heralds a new era of compliance and responsibility in Nigeria’s data protection framework, positioning the nation’s regulatory approach in alignment with global benchmarks.

This article aims to examine the essential provisions of the NDPC Guidance Notice, detailing the classification and registration obligations for data controllers and processors, along with the potential legal ramifications of non-compliance.

Designation and Classification of Data Controllers and Data Processors of Major Importance

The NDPC Guidance Notice provides a structured approach to identifying data controllers and data processors of major importance, highlighting their critical function in managing personal data, particularly at scale or within sensitive sectors. An entity is classified within this category if it processes personal data of over 200 individuals within a six-month period,^[6] reflecting the Commission’s aim to regulate organizations engaged in systematic data collection and storage. Furthermore, businesses that provide commercial ICT services, especially those involved in the storage, analysis, or transfer of personal data on behalf of others, are encompassed in this designation.^[7] It further designates key sectors that hold critical significance to the Nigerian economy, society, or national security, including financial services, telecommunications, healthcare, education, insurance, oil and gas, aviation, tourism, and electric power and the inclusion of these industries emphasizes the rising importance of data protection, especially as Nigeria advances in its digital transformation. In addition to considerations of industry classification and processing volume, the Notice also acknowledges entities with fiduciary responsibilities to data subjects as data controllers or processors of major importance.^[8]

The Notice also introduced a structured three-tier classification system aimed at regulating data controllers and processors of major importance, considering both the extent of data processing activities and the sensitivity of the information involved.^[9] At the topmost level, Major Data Processing – Ultra High Level pertains to organizations that process personal data of over 5,000 individuals within a six-month timeframe. This category encompasses entities such as commercial banks, telecommunications companies, insurance firms, oil and gas corporations, social media platforms, payment service providers, etc.^[10] Due to their considerable responsibilities in data management, these organizations are obliged to comply with the highest global data protection standards which typically entails the implementation of sophisticated cybersecurity infrastructures, adherence to international certification protocols, effective third-party risk management, and rigorous cross-border data transfer regulations.^[11] The necessity for such stringent classification arises from the significant financial and reputational risks linked to data breaches within these sectors, as they handle extensive amounts of personal and financial information.

The Major Data Processing – Extra High Level (MDP-EHL) classification is applicable to entities processing personal data of over 1,000 individuals within six months and these include government ministries, departments, and agencies, microfinance banks, higher education institutions, secondary or tertiary healthcare providers, etc.^[12] Organizations in this category are expected to adhere to global best practices in data protection, ensuring that they maintain secure data storage, uphold processing integrity, and comply with legal mandates at both national and international levels. While the risks associated with MDP-EHL may not reach the same magnitude as those in MDP-UHL, these institutions still manage substantial volumes of sensitive information, such as citizens’ personal records, academic transcripts, and medical histories.^[13]

Finally, the Major Data Processing – Ordinary High Level (MDP-OHL) applies to entities processing personal data of over 200 individuals within a six-month period, including small and medium-sized enterprises, primary and secondary educational institutions, primary healthcare centers, contractors managing data on behalf of larger organizations, etc.^[14] Although these entities may not engage in extensive data processing, they are nevertheless required to implement fundamental technical and organizational data protection measures to mitigate risks associated with unauthorized access, data leaks, or breaches. This classification underscores the importance of ensuring that even smaller businesses and institutions adhere to essential data protection principles, thereby fostering a culture of accountability and security across all sectors within Nigeria.^[15]

Registration, and Compliance Requirements.

To ensure full compliance with the Act, the Commission mandates registration for data controllers and processors of major importance.^[16] The registration of data controllers and processors is crucial, as it provides a legal basis for their operations, enhances data security and accountability, and mitigates risks associated with non-compliance.^[17] By formalizing registration, the Commission aims to create a national database of data controllers and processors,^[18] strengthening regulatory oversight and ensuring that all major data-handling entities operate within the law.

Fees chargeable for registration vary depending on the classification of the data controller or processor. MDP-UHL entities are required to pay a registration fee of ₦250,000, MDP-EHL organizations, to pay ₦100,000 while MDP-OHL entities must pay a registration fee of ₦10,000.^[19] Beyond registration, data controllers and processors must adhere to post-registration obligations, including implementing appropriate security measures, ensuring accountability in data processing, complying with cross-border data transfer regulations, etc. as provided by law. These requirements are essential for maintaining public trust and aligning Nigeria’s data protection framework with international standards.

Failure to register constitutes a violation of the Act and exposes the defaulting entity to regulatory penalties.^[20] Beyond financial and legal penalties, organizations that fail to comply with the registration requirements risk significant reputational damage, as in today’s digital economy, data privacy is a critical concern for consumers, and businesses found to be non-compliant may suffer loss of trust, negative publicity, and potential loss of business opportunities. Compliance with the law is, thus, not merely a legal obligation but also a strategic necessity for businesses and institutions that rely on data-driven operations.

CONCLUSION

The registration of data controllers and processors of major importance in accordance with the NDPC’s Guidance Notice represents a pivotal advancement in the enhancement of Nigeria’s data protection framework. By instituting these compliance requirements, the Commission is dedicated to bolstering accountability, improving data security, and aligning Nigeria with internationally recognized best practices in data privacy. While businesses, particularly SMEs, may encounter higher compliance expenses, the prospective benefits, such as increased consumer trust, legal clarity, and expanded business opportunities, significantly outweigh these hurdles.

REFERENCE

1. Acquisti A, Taylor C, Wagman L. The economics of privacy. Journal of Economic Literature. 2016 1;54(2):442-92 ↑
2. Ezema AO, Ozioko MV. The Importance of Data Governance In Safeguarding Privacy And Security In Nigeria’s Technology Industry: A Legal Review. Nnamdi Azikiwe University Journal of Private and Property Law. 2024 Jul 27;1(1):138-51. ↑
3. Guidance Notice, Registration of Data Controllers and Data Processors of Major Importance; available at https://ndpc.gov.ng/resources/ accessed February 2025 ↑
4. See the introductory paragraph. ↑
5. Paragraph 2 ↑
6. Para 1 of the Notice ↑
7. Ibid. ↑
8. Para 1(2) ↑
9. Para 2. ↑
10. See Para 3(1)(a) ↑
11. See the Nigeria Data Protection Act 2023. ↑
12. Para 3(1)(c). ↑
13. Ibid. ↑
14. Para 3(1)(e). ↑
15. See Idoko, Benjamin, et al. “Enhancing healthcare data privacy and security: A comparative study of regulations and best practices in the US and Nigeria.” Magna Scientia Advanced Research and Reviews (2024) available at https://www.researchgate.net/profile/Victoria-Ayoola-3/publication/382681278_Enhancing_healthcare_data_privacy_and_security_A_comparative_study_of_regulations_and_best_practices_in_the_US_and_Nigeria/links/673b70f888177c79e831209c/Enhancing-healthcare-data-privacy-and-security-A-comparative-study-of-regulations-and-best-practices-in-the-US-and-Nigeria.pdf accessed February, 2025. ↑
16. Para 3. ↑
17. See Babalola, Olumide. “Nigeria’s data protection legal and institutional model: an overview.” International Data Privacy Law 12, no. 1 (2022): 44-52 available at https://academic.oup.com/idpl/article-pdf/12/1/44/42954906/ipab023.pdf accessed February, 2025. ↑
18. See NDPC Repository, Data Controller/Data Processors of Major Importance. Available at https://services.ndpc.gov.ng/repo/?flp=dcmi accessed February, 2025 ↑
19. Para 3. ↑
20. Ibid. see also Part X NDPA 2023 ↑