PoS agents must register with the NDPC: Who is affected and what the court ruling means

• A Federal High Court has ruled that PoS operators must register with the NDPC under the Nigeria Data Protection Act.

• The ruling covers businesses handling customers' personal data, with further guidance expected on who must register.

• The judgement remains enforceable pending any appeal, and non-compliance could attract sanctions.

For millions of Nigerians, using a Point-of-Sale (PoS) terminal has become part of daily life. 

Whether withdrawing cash in a rural community, transferring money after banking hours, or paying bills, PoS agents have become the face of financial inclusion across the country.

But a recent Federal High Court judgement has introduced a new compliance obligation that could affect thousands of these businesses.

The announcement was formally issued in a statement by Babatunde Bamigboye (Esq.), Head of Legal, Enforcement, and Regulations at the NDPC. 

The court has ruled that PoS operators must register with the Nigeria Data Protection Commission (NDPC), affirming that they qualify as entities that process personal data under the Nigeria Data Protection Act (NDPA) 2023. 

The decision settles a legal dispute over whether the Commission had the authority to require their registration and strengthens the government's push to improve data privacy in Nigeria. 

READ NEXT: 10 Things You Need to Start a POS Business in Nigeria

The judgement arose from a lawsuit, Emmanuel Harunna v. Nigeria Data Protection Commission (Suit No. FHC/L/CS/1116/2024), in which the claimant challenged the NDPC's directive requiring PoS operators to register as Data Controllers and Processors of Major Importance (DCPMI).

Harunna had asked the court to declare the directive unlawful and sought a perpetual injunction restraining the NDPC from enforcing the registration requirement against PoS operators.

However, Justice F.N. Ogazi of the Federal High Court, Lagos Division, dismissed the suit, holding that the Commission acted within the powers granted to it by the Nigeria Data Protection Act (NDPA) 2023.

In reaching the decision, Justice Ogazi examined Sections 5(d), 6(c), 44, 45 and 65 of the Act. 

The court held that Section 65, which gives the NDPA overriding effect over any conflicting law relating to personal data protection, empowered the NDPC to regulate PoS operators and classify them under the Major Data Processing – Ordinary High Level (OHL) category of the DCPMI framework.

Following the ruling, the NDPC said the judgement affirms that PoS operators process significant volumes of personal data and are therefore subject to the Commission's regulatory oversight.

READ NEXT: How to apply for INEC Recruitment 2026: Complete guide, requirements and application process

Every time a customer visits a PoS terminal, the operator typically handles sensitive personal information such as:

• Full names

• Phone numbers

• Bank account details

• Bank Verification Number (BVN)-linked transaction records

• Transaction history

• Debit card information (where applicable)

Although agents do not own this information, they process it on behalf of financial institutions and payment service providers.

Under the NDPA, an organisation or individual that determines why personal data is collected is generally regarded as a data controller, while one that processes the information on behalf of another entity is considered a data processor.

Because PoS businesses routinely collect, store or transmit customers' personal information during financial transactions, the court agreed that they fall within the NDPC's regulatory oversight. 

READ ALSO: ⁠⁠Opay vs Palmpay POS: Which is Better?

This is the question many operators are now asking.

The court affirmed the NDPC's authority to require registration, but whether every individual neighbourhood PoS agent must register independently or whether registration can be handled through larger PoS aggregators depends on the Commission's implementation framework.

Many PoS agents operate under licensed fintech companies or super-agent networks rather than as completely independent businesses. 

The NDPC's DCPMI framework generally classifies organisations based on factors such as:

• the volume of personal data processed;

• the sensitivity of the information handled;

• the number of data subjects involved;

• the strategic importance of the organisation's operations.

As implementation progresses, the NDPC is expected to provide further operational guidance clarifying whether registration obligations apply directly to every standalone agent or primarily to licensed operators and aggregator platforms that supervise agent networks. 

Rather than rushing to register independently, neighbourhood PoS agents and terminal operators should take the following steps while awaiting further NDPC guidance:

• Check in with your parent platform/aggregator: Contact the fintech company or bank providing your PoS terminal (e.g., Moniepoint, OPay, or Flutterwave) to confirm if their regulatory compliance covers your agent location.

• Practice basic data privacy: Avoid writing down customer card details, PINs, or BVNs on physical paper notebooks or unencrypted logs.

• Monitor NDPC announcements: Watch for official NDPC implementation guidelines regarding whether standalone agents need independent filings or are covered under super-agent licensing.

The Federal High Court ruling itself did not set a fresh compliance deadline.

Instead, it upheld the NDPC's legal authority to enforce its existing registration requirements.

Operators should therefore follow any compliance timelines subsequently issued by the Commission, as future enforcement notices may specify registration windows or implementation dates.

READ NEXT: FG reveals list of 7 mistakes stopping many Nigerians from getting government jobs

Following the judgement, National Commissioner and Chief Executive Officer of the NDPC, Dr Vincent Olatunji, directed all unregistered major data controllers and processors to register without delay.

Under the Nigeria Data Protection Act 2023, organisations that qualify as Data Controllers and Processors of Major Importance (DCPMI) face administrative penalties of up to ₦10 million or 2% of their annual gross revenue, whichever is higher, for non-compliance.

Other data controllers and processors may face penalties of up to ₦2 million or 1% of annual gross revenue, depending on their classification.

Beyond financial penalties, the NDPC may also impose enforcement measures such as compliance orders, regulatory investigations, operational restrictions and, where applicable, criminal prosecution under the Act.

Nigeria's digital payments ecosystem has expanded rapidly over the past decade, with PoS terminals becoming critical to financial inclusion, particularly in communities with limited access to traditional bank branches.

As these businesses increasingly handle sensitive financial information, regulators argue that stronger data protection safeguards are necessary to protect customers from identity theft, fraud and unauthorised use of personal information.