The Federal High Court of Nigeria (FHC) ruled on 22 November 2024 to nullify certain provisions of the Nigeria Data Protection Commission (NDPC) Guidance Notice on the Registration of Data Controllers and Data Processors of Major Importance (NDPC/HQ/GN/VOL.02/24), issued in February 2024.

The Guidance Notice outlined the criteria for determining which organisations qualify as Data Controllers and Data Processors of Major Importance (DCPMI) in line with sections 5(d), 44, and 65 of the Nigeria Data Protection Act (NDPA). It also categorised organisations under the DCPMI classification.

The case, Frank Ijege v. Nigeria Data Protection Commission (FHC/KD/CS/34/2024), was brought before the FHC in Kaduna State. Mr. Frank Ijege, the applicant, sought several reliefs, including a declaration that the Guidance Notice violated his right to privacy, a clarification of the Notice’s confusing provisions, and a statement that not all individuals or entities qualify as DCPMI.

Additionally, the applicant challenged specific paragraphs of the Guidance Notice as ultra vires, null, and void, and argued that the NDPC should have provided clarity on which entities are exempt from registering as DCPMIs. He also sought an order mandating the NDPC to define entities that do not fall under the DCPMI category and to stop mandating registrations until this clarification was made.

The court ruled in favour of the applicant, granting all reliefs except for the injunction, establishing a significant legal precedent for data protection in Nigeria.

In this publication, authored by our Partner Sumbo Akintola, Senior Associate Timothy Ogele, and Associates Moyinoluwa Jemiriye and Oluwatomi Oni, we analyse the decision of the FHC and explore the implications of the judgment in the Nigerian data protection space.

Click here to download the full publication.