NDPC Newsletter: Registration of Data Controllers and Data Processors of Major Importance
On the 14th of February 2024, the Nigeria Data Protection Commission (NDPC) issued a Guidance Notice which shall govern the registration of ‘Data Controllers/Data Processors of Major Importance’ with the NDPC in accordance with Section 5 of the Nigerian Data Protection Act (NDPA) 2023.
The Guidance Notice emphasizes the importance of the privacy and security of data subjects by ensuring that their personal information is processed by ‘genuine organizations’ and for ‘genuine reasons’ only. The Guidance Notice also offers a much-needed clarification of a data controller/processor of major importance to be an entity of “particular value or significance to the economy, society, or security of Nigeria” that keeps or has access to a filing system (whether analogue or digital) for the processing of personal data and processes personal data of more than 200 data subjects within six months, or engages in commercial Information Communication Technology (ICT) services on any digital device with storage capacity that belongs to another individual or processes personal data within specific sectors, including Financial, Communication, Health, Education, Insurance, Export and Import, Aviation, Tourism, Oil and Gas, and Electric Power.
In addition to this, the Guidance Notice further creates a 3-level classification of data controllers and processors based on their level of importance; Major Data Processing-Ultra High Level (MDP-UHL), Major Data Processing-Extra High Level (MDP-EHL), and Major Data Processing-Ordinary High Level (MDP-OHL). Each category of data controller and processor is expected to abide by global standards of data protection and specific criteria, including the number of data subjects whose personal data is processed. The Guidance Notice also differentiates the registrable fees payable by each organization based on the application category. The registration fees are N250,000 for MDP-UHL, N100,000 for MDP-EHL, and N10,000 for MDP-OHL.
The Guidance Notice reiterates the registration period of 30th January 2024 – 30th June 2024. Organizations are advised to complete their registration with the NDPC as failure to register by the due date or failure to register shall be deemed as a default under the Act, and a data controller or data processor in default is liable to a penalty as stipulated in the Act.
As a value-add, Jackson Etti & Edu will assist clients who have engaged us as a Data Protection Compliance Organization with the registration process at no additional professional fee.
For further information, kindly reach the key contacts below:
Tel: +234 (1) 905 0000 / +234 (1) 4626841
Mobile: +234 805 440 0049
Fax: +234- 1- 2716889
Email: Ngozi.Aderibigbe@jee.africa
Tel: +234 (02) 014626841/3
Email: ifeanyi.okonkwo@jee.africa