Court affirms NDPC power to register PoS operators, sets registration fees

The Federal High Court has ruled that the Nigeria Data Protection Commission (NDPC) has the legal authority to register and regulate Point of Sale (PoS) operators across Nigeria. The judgment, delivered in the case Emmanuel Harunna v. Nigeria Data Protection Commission (FHC/L/CS/1116/2024), affirms that PoS operators must register as Data Controllers and Processors of Major Importance (DCPMIs) under the Nigeria Data Protection Act (NDPA) 2023.

The court ruling and what it means

The court dismissed a lawsuit that sought to exempt PoS operators from mandatory registration. It ruled that the NDPC acted within its legal mandate by classifying eligible operators as DCPMIs. Businesses that collect, process or store substantial volumes of personal information now fall under the Commission's regulatory scope and must comply with registration requirements.

The judgment reinforces the NDPC's power to oversee organisations handling sensitive customer data. PoS operators routinely collect names, phone numbers, bank details and transaction records, placing them squarely within the data protection framework.

What the NDPC says

The Commission said compulsory registration is designed to promote accountability, transparency and responsible data governance. It also enables regulators to monitor compliance with existing data privacy laws. The NDPC stressed that the requirement does not infringe on the constitutional right to privacy. Instead, it strengthens that right by ensuring organisations entrusted with personal information operate under clear legal and regulatory standards.

Following the court's decision, the National Commissioner and Chief Executive Officer of the NDPC, Dr Vincent Olatunji, directed all affected data controllers and processors that have not yet registered to complete the process without delay. The Commission warned that businesses ignoring the directive could face sanctions and other legal consequences under the Nigeria Data Protection Act.

Registration fees for PoS operators

Under the NDPC's 2024 Guidance Notice, organisations classified as DCPMIs are grouped into three categories based on the scale and impact of their data processing activities. The registration fees are:

Ultra High Level: ₦250,000
Extra High Level: ₦100,000
Ordinary High Level: ₦10,000

The applicable category depends on the volume of personal data processed and the organisation's significance to Nigeria's economy, society or national security.

What this means for PoS operators and the naira

Industry observers say the decision is expected to raise compliance standards within the agency banking sector while improving consumer confidence in the handling of personal and financial data. For PoS operators, the message is clear: compliance with Nigeria's data protection laws is no longer optional. Those yet to register must do so promptly to avoid regulatory penalties. The move signals a tougher enforcement approach as the government seeks to improve data governance across industries handling sensitive customer data, which could also boost trust in the cashless economy and support the naira by encouraging more formal financial transactions.