NDPC PoS Agent Registration Rule Upheld by Federal Court

In Short

Nigeria PoS agents must now register with the Nigeria Data Protection Commission, after a Federal High Court upheld the requirement under the Nigeria Data Protection Act 2023.

What Happened

The Nigeria Data Protection Commission, NDPC, says Point of Sale, PoS, agents fall under “Data Controllers and Processors of Major Importance”, DCPMIs. That label applies to people or organisations that handle significant volumes of personal data, like names, phone numbers, account details, and transaction records.

The Commission announced the update after a Federal High Court judgment in a case filed to stop the rule. The case, Emmanuel Harunna v. Nigeria Data Protection Commission (FHC/L/CS/1116/2024), challenged whether PoS agents should be included in NDPC’s registration framework.

Justice F.N. Ogazi dismissed the application and upheld NDPC’s authority to require registration. The court reviewed NDPC’s Guidance Notice on Registration and several sections of the Nigeria Data Protection Act, NDPA 2023, and found the Commission acted within its legal powers.

The NDPC also said the court ruled the registration requirement does not breach the constitutional right to privacy. Instead, it strengthens privacy by bringing major data handlers under clearer oversight and compliance checks.

Why It Matters

PoS agents are one of the largest “offline to digital” payment channels in Nigeria. Many agents collect customer details during cash-in, cash-out, transfers, and bill payments. That makes them a major point where data leaks, scams, and identity misuse can happen.

The NDPC says registration helps it identify who is processing data at scale and monitor whether they follow data protection rules. In simple terms, it creates a list of high-impact data handlers and gives regulators a clearer enforcement path.

After the judgment, NDPC’s leadership directed all affected DCPMIs that have not registered to do so immediately. The agency warned that non-compliance can create legal liabilities under the NDPA.

For fintechs and payment companies that rely on agent networks, the ruling could mean tighter compliance requirements across onboarding, record-keeping, consent (clear permission to use someone’s data), and security controls for PoS operations.