On February 15, 2024, the Nigeria Data Protection Commission (NDPC) issued a guidance notice on the registration of data controllers and processors. In particular, the NDPC notes the importance of processing personal data by genuine persons or organizations and for genuine reasons in order to ensure the privacy and security of data subjects.

What are the compliance requirements?

Specifically, the notice takes into account data controllers and processors of major importance, meaning that they bring particular value or significance to the economy, society, or security of Nigeria. The NDPC classifies these entities into three categories based on data processing intensity, with their corresponding registration fees, including:

• major data processing-ultra high level (MDP-UHL), including national commercial banks, telecommunications companies, insurance companies, etc., with a registration fee of NGN 250,000 (approx. $160);
• major data processing-extra high level (MDP-EHL), including government entities, microfinance banks, higher education institutions, etc., with a registration fee of NGN 100,000 (approx. $60); and
• major data processing-ordinary high level (MDP-OHL), including small and medium scale enterprises, primary and secondary schools, primary health care centers, etc., with a registration fee of NGN 10,000 (approx. $6).

The NDPC mentions that existing data controllers and processors must register between January 30, 2024, and June 30, 2024, and failure to do so or late registration incurs penalties as per the Nigerian Data Protection Act, 2023.

You can read the guidance here.