To enhance data protection measures and accountability in Nigeria, the Nigeria Data Protection Commission (NDPC) has released a crucial Guidance Notice mandating the registration of data controllers and processors in accordance with the Nigeria Data Protection Act (NDPA) of 2023.
The Guidance Notice, marked NDPC/HQ/GN/VOL.02/24, serves to clarify the types of organizations required to register with the Commission, aligning with the provisions outlined in sections 5(d), 44, and 65 of the NDPA. According to the Commission, organizations deemed to be of “particular value or significance to the economy, society, or security of Nigeria” fall under the category of data controllers and processors of major importance.
Issued on February 14th and signed by Babatunde Bamigboye, Esq., the Commission’s Head of Legal Enforcement and Regulations, the notice stipulates that entities retaining or having access to filing systems for processing personal data are designated as major importance data controllers or processors.
Furthermore, the Commission has highlighted specific data processing activities, including those involving sensitive personal data, cloud computing, transborder data transfers, and handling the personal data of over 200 data subjects, as key factors in determining organizations falling under this designation.
To streamline compliance and foster business facilitation, especially for smaller entities engaged in potentially high-risk data processing, the NDPC has introduced a tiered fee structure based on Major Data Processing (MDP) levels. These levels include Ultra High Level (UHL), Extra High Level (EHL), and Ordinary High Level (OHL), with corresponding fees of N250,000, N100,000, and N10,000, respectively.
The Guidance Notice further delineates the categorization of organizations within each MDP level, ranging from commercial banks and telecommunication companies under MDP-UHL to small and medium-scale enterprises (SMEs) and primary health centers within MDP-OHL.
Dr. Vincent Olatunji, the NDPC’s National Commissioner and CEO, emphasized the critical importance of data protection in light of increasing digital transactions and online data sharing practices among Nigerians. Dr. Olatunji urged data controllers to prioritize citizen safety and accountability, cautioning against activities that may compromise individuals’ personal data, including bank details, health records, and academic information.
Dr. Olatunji emphasized, “The risks are getting higher even as the opportunities are also increasing… Registration is one in a continuum of measures we are taking in this regard. It is, however, the entry point of accountability going forward.”
The detailed breakdown of organizational categories and registration requirements can be found on the NDPC’s official website at www.ndpc.gov.ng.
The issuance of this Guidance Notice underscores Nigeria’s commitment to bolstering data protection frameworks and safeguarding citizens’ privacy rights in the digital age.
