On 14th February 2024 the Nigeria Data Protection Commission ('the Commission') released a Guidance Noticeon the Registration of Data Controllers and Processors of Major Importance [NDPC/HQ/GN/VOL.02/24] ('theGuidance Notice') providing clarity as to designation and categorisation of Data Controllers and Data Processors of Major Importance who are required to register with the Commission.
The Nigeria Data Protection Act (NDPA) 2023, introduced the categorisation of data processors and data controllers into data controllers and processors of major importance and data controllers and processors not of major importance. Section 44 of the NDPA provides that data processors and data controllers of major importance are required to register with the Commission 6 months after the commencement of the Act. Section 65 of the NDPA further defines a data processor and controller of major importance as an organisation that 'is domiciled, resident in, or operating in Nigeria and processes or intends to process personal data of more than such number of data subjects who are within Nigeria, as the Commission may prescribe, or such other class of data controller or data processor that is processing personal data of particular valueor significance to the economy, society or security of Nigeria as the Commission may designate'.
Further to the definition of data controllers and data processors of major importance, and the provision of section 5(d) of the NDPA that empowers the Commission to designate data controllers and processors of major importance who are to register with the Commission, the Commission issued the aforementioned Guidance Notice to provide a clear description in the determination of a data controller or processor of major importance. Thus, a data controller and processor shall be designated to be a data controller and processor of major importance and deemed to carry on processing of 'particular value or significance to the economy, society or security of Nigeria' if:
Financial |
Communication |
Health |
Education |
Aviation |
Insurance |
Export and Import |
Electric Power |
Tourism |
Oil and Gas |
Furthermore, a data controller or data processor shall be designated a data controller or data processor of major importance where such a data controller or processor is under a fiduciary relationship with a data subject by reason of which it is expected to keep confidential information on behalf of the data subject, taking into account the significant harm that may be done by the data subject if such a data controller or processor is not under such obligations imposed by virtue of being designated a data controller or processor of major importance.
The Commission has classified data controllers and data processors into 3 categories of data processing. The registration of data controllers and processors of major importance are subject to these categories and their prescribed official fees, and the sectors/organisations that fall within the categories, as provided for by the Commission. These categories are:
MDP-UHL shall also include organisations that process personal data of over 5,000 (five thousand) data subjects within 6 (six) months.
MDP-EHL shall also include organisations that process personal data of over 1,000 (one thousand) data subjects within 6 (six) months.
MDP-OHL shall also include organisations that process personal data of over 200 (two hundred) data subjects within 6 (six) months.
Conclusion
Existing data controllers and data processors are to register with the Commission between 30th January 2024 and 30th June 2024. Failure to register or registration after the due date shall be deemed a default under the NDPA and such defaulting data controller or processor shall be liable to the penalty.
It is therefore imperative that data controllers and data processors commence the registration process with the Commission. It is advisable that the services of a licensed Data Protection Compliance Officer (DPCO) be engaged to ensure an efficient registration process.
Originally published 28 February 2024
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.