If there is one lesson I have learned from working closely with thousands of Point of Sale (PoS) agents across Nigeria, it is that many operators are so focused on serving customers and growing their businesses that they sometimes miss important regulatory updates that could affect their operations.
Over the years, I have trained and onboarded PoS agents in different states as part of my work in the fintech industry. One of the questions agents frequently ask me is whether new government policies apply to them or only to banks and large financial institutions. This latest development is one every PoS operator should pay attention to because it concerns how customer information is handled and the legal responsibilities that come with operating a PoS business.
In a significant judgment that could affect thousands of PoS businesses across Nigeria, the Federal High Court has upheld the powers of the Nigeria Data Protection Commission (NDPC) to require Point of Sale (PoS) agents to register as Data Controllers and Processors of Major Importance (DCPMIs) under the Nigeria Data Protection Act (NDPA) 2023.
The ruling means that eligible PoS operators covered by the Commission’s classification must comply with the registration requirements or risk facing legal consequences.
Federal High Court Dismisses Challenge Against NDPC
The judgment was delivered in the case Emmanuel Harunna v. Nigeria Data Protection Commission (FHC/L/CS/1116/2024).
The applicant had asked the court to declare that PoS agents should not be classified as Data Controllers and Processors of Major Importance under the Nigeria Data Protection Act. The suit also sought a perpetual injunction restraining the NDPC from compelling PoS agents to register with the Commission.
However, after examining the relevant provisions of the Nigeria Data Protection Act, Justice F. N. Ogazi ruled in favour of the NDPC.
According to the Commission, the court held that the NDPC acted within the powers granted to it by law when it designated organisations involved in Major Data Processing – Ordinary High Level (OHL) as Data Controllers and Processors of Major Importance.
Why PoS Agents Are Affected
Many people think a PoS business is simply about cash withdrawals and deposits. From my experience, that is far from the complete picture.
Every day, PoS agents process customers’ personal information, including names, account numbers, phone numbers, Bank Verification Numbers (BVNs) in some instances, transaction records and other sensitive financial data.
Because they routinely process personal information belonging to members of the public, the NDPC considers eligible PoS operators to fall within Nigeria’s data protection framework.
The Commission believes registration will strengthen accountability, improve compliance with data protection standards and ensure that Nigerians’ personal information is handled responsibly.
Court Says Registration Supports Privacy Rights
One important aspect of the judgment is that the court rejected the argument that mandatory registration violates citizens’ constitutional right to privacy.
Instead, Justice Ogazi held that the registration framework actually strengthens privacy protection because it enables the Commission to identify organisations processing significant volumes of personal data and monitor their compliance with the law.
The court further noted that the objectives of the registration system are consistent with the Nigeria Data Protection Act, which promotes transparency, accountability and responsible governance of personal information.
NDPC Orders Immediate Compliance
Following the judgment, the National Commissioner and Chief Executive Officer of the NDPC, Dr. Vincent Olatunji, directed all organisations that qualify as Data Controllers and Processors of Major Importance but have not yet registered to do so without delay.
The directive was conveyed in a statement signed by the Commission’s Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, Esq.
According to the NDPC, failure to comply with the registration requirement could expose affected organisations to serious legal liabilities under the Nigeria Data Protection Act.
The Commission added that compliance not only satisfies legal obligations but also helps build public confidence while protecting the rights and freedoms of individuals whose personal information is processed.
What This Means for PoS Agents
As someone who works closely with PoS operators, I believe this announcement should not create panic.
Rather, it should encourage operators to become more aware of their responsibilities regarding customer information.
Every successful PoS business depends heavily on customer trust. People hand over their ATM cards, phone numbers, account details and other sensitive information because they believe their data will remain secure.
With this judgment, regulators are making it clear that businesses handling such information must operate within Nigeria’s established data protection framework.
If your business falls within the NDPC’s classification of Data Controllers and Processors of Major Importance, it is advisable to begin the registration process promptly and familiarise yourself with your obligations under the law.
Understanding the NDPC Registration Categories
The Nigeria Data Protection Commission introduced its registration framework in 2024 through a Guidance Notice that classifies organisations according to the volume and significance of the personal data they process.
The Commission explains that organisations considered to be of particular importance to Nigeria’s economy, society or national security are designated as Data Controllers and Processors of Major Importance.
To make compliance easier, especially for smaller businesses, the NDPC created three categories of Major Data Processing (MDP):
- Ultra High Level (UHL) – Registration fee: ₦250,000
- Extra High Level (EHL) – Registration fee: ₦100,000
- Ordinary High Level (OHL) – Registration fee: ₦10,000
The applicable category depends on the nature and scale of the organisation’s data processing activities.
Why This Matters for Nigeria’s Digital Economy
Nigeria’s financial technology industry has grown rapidly over the last decade, with PoS agents becoming an important part of financial inclusion across rural and urban communities.
As more financial transactions move into digital channels, protecting personal information has become increasingly important.
The Federal High Court’s decision reinforces the authority of the Nigeria Data Protection Commission to regulate organisations handling sensitive personal information while strengthening confidence in Nigeria’s digital financial ecosystem.
For PoS operators, the judgment serves as a reminder that compliance is no longer limited to banking regulations alone. Data protection has become an essential part of operating a modern financial services business.
My Advice to PoS Agents
From my experience working with merchants and PoS operators across Nigeria, I always encourage business owners not to ignore regulatory updates.
Many regulations are introduced not to frustrate businesses but to improve trust, protect customers and strengthen the financial system.
If you operate a PoS business, this is a good time to review your compliance obligations, understand whether your business falls within the NDPC registration requirements and ensure that your customers’ personal information is handled securely.
As Nigeria’s fintech industry continues to evolve, businesses that embrace compliance early are often better positioned to earn customer confidence and achieve sustainable growth.