A Federal High Court has ruled that Point-of-Sale (PoS) agents across Nigeria must register with the Nigeria Data Protection Commission (NDPC) as Data Controllers and Processors of Major Importance (DCPMIs), making them subject to the provisions of the Nigeria Data Protection Act (NDPA) 2023.
The judgment, delivered by Justice F.N. Ogazi in the case of Emmanuel Harunna v. Nigeria Data Protection Commission, dismissed a suit challenging the NDPC’s decision to classify PoS operators as major data processors.
The court held that the Commission acted within its statutory powers and affirmed that the registration requirement strengthens data privacy protections rather than infringes on constitutional rights.
Following the ruling, NDPC National Commissioner and Chief Executive Officer, Dr. Vincent Olatunji, directed all unregistered Data Controllers and Processors of Major Importance to register immediately, warning that non-compliance could expose operators to legal sanctions under the NDPA.
Why PoS Agents Are Covered
The court noted that PoS operators process large volumes of sensitive personal and financial information, including customers’ bank account details, Bank Verification Numbers (BVNs), transaction records and, in some cases, biometric authentication.
With an estimated two million PoS agents operating approximately 5.9 million active terminals nationwide, the NDPC argued that the sector handles data significant enough to require formal regulatory oversight.
Registration Fees
Under the NDPC’s registration framework, organisations are grouped into three categories based on the scale of data processing:
- Ultra High Level: ₦250,000
- Extra High Level: ₦100,000
- Ordinary High Level: ₦10,000
Most PoS agents are expected to fall under the Ordinary High Level category, requiring a ₦10,000 registration fee.
Compliance Requirements
As registered Data Controllers and Processors of Major Importance, PoS operators will be required to:
- Process personal data on a lawful basis.
- Implement adequate security measures to protect customer information.
- Maintain records of data processing activities.
- Respond to customer requests relating to their personal data.
- Report data breaches to the NDPC within timelines prescribed by law.
Industry Concerns
The ruling introduces new compliance obligations for thousands of small-scale PoS operators, many of whom operate as sole proprietors or micro-businesses.
Industry observers note that while the registration fee may appear modest, it comes at a time when PoS agents are already grappling with increasing operational costs, including CBN charges, network fees and cash management expenses.
Concerns have also been raised about the limited awareness of the new requirements, with many operators reportedly unaware that they are now legally classified as major data processors.
Court Affirms NDPC Powers
The court further ruled that Section 65 of the Nigeria Data Protection Act 2023 supersedes any conflicting legislation relating to data protection, reinforcing the NDPC’s authority to regulate organisations that process significant volumes of personal data.
The decision removes legal uncertainty surrounding the Commission’s 2024 guidance that designated PoS operators as Data Controllers and Processors of Major Importance.
The ruling is expected to significantly expand Nigeria’s data protection compliance regime, bringing one of the country’s largest informal financial service networks under formal regulatory oversight while placing greater emphasis on safeguarding customers’ personal and financial information.