The national commissioner of the Nigeria Data Protection Commission (NDPC), Dr. Vincent Olatunji has extended the deadline for the registration of data controllers and data processors of major importance (DCPMIs) to October 31, 2024. This extension allows for continued registration without penalty.
By Sections 24(3), 29(1)(a), and 44 of the Nigeria Data Protection Act (NDP Act) 2024, DCPMIs can only engage agents and contractors registered with the commission by October 15, 2024, for processing personal data. The NDP Act emphasises that any data controller or processor must ensure that their data processor complies with the same principles and obligations as the controller.
Section 65 of the NDP Act defines a data processor as any individual, private entity, public authority, or other body that processes personal data on behalf of or at the direction of a data controller or another processor.
The commission’s head of legal, enforcement, and regulations, Babatunde Bamigboye, Esq, advised all DCPMIs to ensure that those processing personal data on their behalf fulfil their registration obligations. Engaging any agent or contractor who does not comply with the principles and obligations outlined in the NDP Act is a violation of the law.
The extension aims to give data processors more time to comply while ensuring that all parties meet the legal requirements to process personal data responsibly.
