The Nigeria Data Protection Commission (NDPC) has issued a proactive guidance notice (NDPC/HQ/GN/VOL.02/24) to highlight the obligation for data controllers and processors of major importance to register with the commission, in a move to reinforce the adherence to the Nigeria Data Protection Act (NDPA) 2023.
The notice, released on February 14, categorises organisations deemed of “particular value or significance to the economy, society, or security of Nigeria” as data controllers and processors of major importance.
The guidance notice, signed by the commission’s head of legal enforcement and regulations, Babatunde Bamigboye, Esq. specifies that entities with access to a filing system for processing personal data fall within the major importance designation. Furthermore, the commission identifies specific data processing activities, such as handling sensitive personal data, engaging in cloud computing, executing transborder data transfers, processing personal data of over 200 data subjects, and accessing third-party data storage platforms in commercial transactions, as criteria for designating organisations as data controllers or processors of major importance.
To streamline the registration process and facilitate business operations, the NDPC has introduced a tiered fee structure based on the level of major data processing (MDP) involved. The three levels include ultra-high level (UHL), extra-high level (EHL) and ordinary high level (OHL) of major data processing, with corresponding fees of N250,000, N100,000 and N10,000, respectively.
Organisations falling under the MDP-UHL category encompass national or regional commercial banks, merchant banks, telecommunication companies, insurance companies, multinational companies and payment gateway service providers. MDP-EHL includes government ministries, departments and agencies, microfinance banks, higher institutions and hospitals providing tertiary or secondary medical services. MDP-OHL encompasses small and medium-scale enterprises, primary and secondary schools, primary health centres and agents, contractors and vendors engaging with data subjects on behalf of other organisations.
The detailed breakdown of these categories is available in the Guidance Notice, accessible on the Commission’s website.
The NDPC’s national commissioner, Dr. Vincent Olatunji emphasises the need for vigilance among data controllers, particularly in a digital landscape where millions of Nigerians share personal data online. Olatunji notes that with increasing opportunities come higher risks, underscoring the importance of accountability. He states, “Registration is one in a continuum of measures we are taking in this regard. It is, however, the entry point of accountability going forward”.
The NDPC’s strategic move seeks to enhance compliance with data protection regulations and ensure responsible data handling practices among organisations deemed of major importance.
