On 14th February 2024, the Nigeria Data Protection Commission (the “Commission”) issued a Guidance Notice (“the Notice”) on the registration of Data Controllers and Data Processors of Major Importance (DCMI and DPMI).
Section 65 of the NDPA defines a DCMI and DPMI as a data controller or data processor that is domiciled, resident in, or operating in Nigeria and processes or intends to process personal data of more than such number of data subjects who are within Nigeria as the Commission may prescribe, or such other class of data controller or data processor that is processing personal data of particular value or significance to the economy, society or security of Nigeria as the Commission may designate.
It was directed that all DCMIs and DPMIs register with the Commission before the expiration of the timeline set by the Commission. The deadline for registration, which was initially set for 30th June 2024, has since been extended to 31st September 2024 and subsequently to 31st October 2024.
Whilst the Commission is yet to issue any further directive on the issue of the deadline, it is important to note that DCMIs/DPMIs will be restricted from engaging unregistered Data Processors, as mandated by the Commission. Non-compliance with this requirement may result in penalties under the Nigerian Data Protection Act 2023, including fines of up to 2% of annual gross revenue.
The Commission has stated that a data controller or data processor shall be considered of major importance if it maintains or has access to a filing system for processing personal data where it:
- Processes the personal data of more than 200 data subjects in six months;
- Carries out commercial technology services on any digital device that has storage capacity and belongs to another individual.
- Processes personal data as an organization or a service provider in the listed major sectors of the economy.
- Has a fiduciary relationship with a data subject, requiring it to maintain the confidentiality of the data, especially given the potential significant harm to the data subject if the data controller or processor is not bound by the obligations placed on controllers or processors of major importance.
