Federal High Court upholds NDPC’s power to register data controllers of major importance

Image: Iliaswiki23 / Wikimedia Commons, CC BY-SA 4.0

In Harunna v NDPC, the court held that the Commission's registration regime for data controllers and processors of major importance is lawful and consistent with the constitutional right to privacy.

Jurisdiction NigeriaPractice Competition and Regulatory, Technology, Media and TelecomsSector Technology

The Federal High Court has upheld the power of the Nigeria Data Protection Commission (NDPC) to register Data Controllers and Data Processors of Major Importance (DCPMIs), Nigeria CommunicationsWeek reported on 27 July 2026. Justice F.N. Ogazi gave judgment in Emmanuel Harunna v. Nigeria Data Protection Commission, Suit No. FHC/L/CS/1116/2024.

The holdings

According to the report, the court held that the NDPC has statutory authority under the Nigeria Data Protection Act, 2023 (NDPA) to require DCPMIs to register. It rejected the argument that the registration requirement violates the constitutional right to privacy, finding that the framework protects that right through regulatory oversight. The court held that the Commission’s Guidance Notice on Registration falls within the constitutional safeguards in section 45 of the 1999 Constitution, which allows laws reasonably justifiable in a democratic society. It also held that section 65 of the NDPA prevails over conflicting provisions in other laws on the processing of personal data.

The court accepted the Commission’s rationale that “the registration framework enables the commission to identify organisations engaged in significant data processing activities and effectively monitor compliance with the law.”

Why it matters

Registration is the foundation of the NDPC’s enforcement model. It tells the Commission which organisations process data at scale, and it is linked to annual compliance audit returns and fees. A successful challenge would have undermined the Commission’s ability to identify and monitor businesses. The judgment removes that uncertainty for now, subject to any appeal.

The holding on section 65 is significant for regulated businesses. Companies in banking, telecoms, health and other sectors are subject to sector rules on data and confidentiality alongside the NDPA. A ruling that the NDPA prevails over conflicting provisions strengthens the Commission’s position when its requirements overlap with those of sector regulators, and businesses should expect the NDPC to rely on it in enforcement.

For businesses that have not registered on the assumption that the regime might be struck down, the practical advice is to review whether they meet the criteria for major importance, register, and file compliance audit returns through a licensed Data Protection Compliance Organisation. For counsel, the case also indicates that constitutional privacy arguments are unlikely to succeed against the structural features of the NDPA, so challenges to enforcement action are more likely to turn on procedure and the facts of each case.