The Nigeria Data Protection Commission (NDPC) has extended the deadline for the registration of Data Controllers and Data Processors of Major Importance (DCPMIs). The new deadline, approved by the Commission’s National Commissioner/CEO, Dr. Vincent Olatunji, is now set for October 31, 2024, allowing affected entities to register without penalty.
This extension comes as part of the Commission’s effort to ensure full compliance with the Nigeria Data Protection Act, 2024 (NDP Act). Under sections 24(3), 29(1)(a), and 44 of the NDP Act, DCPMIs are required to only engage agents and contractors registered with the NDPC by October 15, 2024, for the processing of personal data.
According to Section 29(1)(a), a data controller or processor must ensure that any entity they engage for data processing complies with the obligations and principles outlined in the NDP Act, as applicable to the data controller. Section 65 further defines a data processor as any individual, private entity, public authority, or body that processes personal data on behalf of, or as directed by, a data controller or another data processor.
The Commission is urging all DCPMIs to immediately ensure that their agents and contractors fulfill their legal obligation to register, emphasizing that failure to do so is a violation of the NDP Act.
This directive was signed by Barrister Bamigboye, Esq., Head of Legal, Enforcement & Regulations at the NDPC.
