The Nigerian Data Protection Commission (“the NDPC” or “the Commission”) on February 14, 2024, issued a Guidance Notice on the registration of data controllers and data processors of major importance (“the Guidance Notice” or “the Notice”) directing all designate data controllers or data processors of major importance to register with the Commission.

The Notice was issued in accordance with the Commission’s function under Section 5 (d) of the Nigerian Data Protection Act (“the NDPA” or “the Act”) to register data controllers and data processors of major importance; its powers pursuant to Section 6 (c) to issue regulations, rules, directives and guidance under the Act and the obligation on data controllers and data processors of major importance to register with the Commission within six months after the commencement of the Act pursuant to Section 44 of the Act.

The term, ‘data controller and data processor of major importance’ is defined under section 65 of the NDPA as:

a data controller or data processor that is domiciled, resident in, or operating in Nigeria and processes or intends to process personal data of more than such number of data subjects who are within Nigeria, as the Commission may prescribe, or such other class of data controller or data processor that is processing personal data of particular value or significance to the economy, society or security of Nigeria as the Commission may designate.

While the NDPA defines who a data controller or data processor of major importance is, it does not specify the criteria for qualification as data controller or data processors of major importance. The Guidance Notice, however, clarifies and outlines the criteria for identifying a data controller or data processor of major importance.