Introduction

In Nigeria, the regulation of data protection and privacy has gained significant attention, particularly since the enactment of the Nigeria Data Protection Act, 2023 (NDPA or NDPA, 2023). The focus includes concerns regarding the Nigerian Data Protection Commission’s (“the NDPC” or “the Commission”) power to make subsidiary legislation and this has resulted in a number of Court cases seeking judicial clarification on the scope of this power.

A judgment has recently been passed in this regard by the Federal High Court in the case of Frank Ijege v. Nigeria Data Protection Commission (NDPC). This case essentially examined the legality of the Commission’s Guidance Notice issued in 2024 on the registration of data controllers and data processors of major importance (“the Guidance Notice” or “the Notice”). The judgment of the Court has legal implications for Nigeria’s data protection landscape, emphasising the need for regulatory actions to align strictly with statutory provisions to avoid overreach. This case also underscores the importance of clear and precise regulatory guidelines in the realm of data protection, ensuring that the rights of individuals are safeguarded without imposing unnecessary burdens on data controllers and processors.

Background: NDPC’s Guidance Notice on the Registration of Data Controllers and Data Processors of Major Importance

The Commission, on February 14, 2024, issued a Guidance Notice on the registration of data controllers and data processors of major importance, directing all designated data controllers or data processors of major importance (“DCDPMI”) to register with the Commission. The Notice was issued in accordance with the Commission’s function under Section 5(d) of the NDPA 2023 to register data controllers and data processors of major importance; its powers to issue regulations, rules, directives and guidance under the Act, and the obligation on DCDPMI to register with the Commission within six months after the commencement of the Act.

Under the Guidance Notice, the Commission provided the criteria for the designation of data controller or data processor of major importance to include:

1. A data controller or data processor shall be deemed to have “particular value or significance to the economy, society or security of Nigeria” and designated to be of major importance if it keeps or has access to a ling system (whether analogue or digital) for the processing of personal data; and where it meets any of the following conditions:
2. a) Processes the personal data of more than 200 data subjects in six months; or
3. b) Carries out commercial Information Communication Technology (ICT) services on any digital device which has storage capacity and belongs to another individual; or
4. c) Processes personal data as an organisation or a service provider in any of the following sectors: (i.) Financial (ii.) Communication (iii.) Health (iv.) Education (v.) Insurance (vi.) Export and Import (vii.) Aviation (viii.) Tourism (ix.) Oil and Gas (x.) Electric Power.
5. A data controller or a data processor under a fiduciary relationship with a data subject and is obligated to keep confidential information on behalf of the data subject is regarded as a data controller or data processor of major importance taking into consideration the significant harm that may be done to a data subject if such data controller or processor is not under the obligations imposed on data controllers or processors of major importance

The Commission also classifies these DCDPMI into three major categories which are Major Data Processing- Ultra High Level (MDP-UHL), Major Data Processing- Extra High Level (MDP- EHL), and Major Data Processing- Ordinary High Level (MDP-OHL). Under these categories, the Guidance Notice specifies certain factors, any of which would guide the classification of DCDPMI. Our publication on the guidance notice can be accessed here.