Introduction to data controllers and processors
Data controllers and data processors are entities who deal with personal data. As much as they have a similar scope of operation, they remain distinct in various other aspects, like in their legal obligations, liability, fines, accountability, and the likes. In Nigeria, the terms data controller and data processor were first formally used in 2019, where they occurred in the Nigeria Data Protection Regulation (NDPR)[1]. The NDPR was Nigeria’s first data privacy regulation, which was issued by the Nigeria Information Technology Development Agency (NITDA)[2], and was later replaced by the Nigeria Data Protection Act (NDPA)[3]. The NDPA also made use of both terms. According to the NDPA, personal data refers to any information relating to an individual who can be identified or is identifiable, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, psychological, genetic, cultural, social, or economic identity of that individual. It can simply be referred to as any information that pertains to an individual. Their main purpose is the proper processing of personal data.
Definition of data controllers and processors
Section 65 of the NDPA[4]interpreted a Data Controller as an individual, private entity, public commission, agency, or any other body who, alone or jointly with others, determines the purposes and means of processing personal data. They possess the power to make decisions as to the why and how data should be collected, stored, used, and processed.
Section 65[5] also described a Data Processor as an individual, private entity, public authority, or any other body who processes personal data on behalf of or at the direction of a data controller or another data processor. This simply means that a data processor acts upon instructions given to them by the controller or another processor in the processing of personal data. They don’t have decision-making powers as to the processing of personal data; they merely act on instructions given to them.
At times, both functions are combined in a single body. They’re referred to as Data Controllers or Data Processors of Major Importance (DCPMI). Section 65[6]refers to them as being domiciled, resident in, or operating in Nigeria and processing or intending to process personal data of more than such number of data subjects who are within Nigeria, as the Commission may prescribe, or such other class of data controller or data processor that is processing personal data of particular value or significance to the economy, society, or security of Nigeria as the Commission may designate. This concept was introduced by the NDPC Guidance Notice[7]. It refers to a person who acts on instructions and, at the same time, determines the purposes and means of processing the personal data. Under the NDPA General Application and Implementation Directive (GAID)[8], the DCPMIs are categorized into 3 tiers, which are the Ultra-High, Extra-High, and Ordinary-High Levels, and the NDPC Guidance Notice sets out their criteria and obligations.
How do we identify data controllers and processors?
In identifying a Data Controller, you need to consider the role they play and the tasks they perform.
A Data Controller is one who has the decision-making power, who decides why the data is collected, what data is collected, and how it is collected, stored, and used.
Data Controllers can make independent decisions and don’t act on instructions.
A Data Controller is legally obligated to process data based on the principles of personal data processing[9] .
A Data Controller is one who ensures that the privacy policy is made known to the data subjects[10]. They also uphold the data subjects’ rights.
Data Controllers conducts a data privacy impact assessment prior to processing where there’s an envisaged high risk[11].
A Data Controller notifies the NDPC of a breach that is likely to result in a risk to the data subjects within 72 hours of being aware of the breach[12].
The Data Controller will be liable to the data subjects for breaches that occur as a result of violation of the Act and failure to perform their statutory duty of care[13] .
The Data Controller is the one who makes the written agreement (Data Processing Agreement – DPA) between himself and the Data Processor[14].
Data Processor:
A Data Processor, on the other hand, acts mainly upon instructions given by a Data Controller or another Data Processor and doesn’t make sole decisions.
Data Processors are legally obligated to maintain compliance with the NDPA, assist the Data Controller in honouring the data subjects’ rights, and implement necessary measures to ensure the security and confidentiality of the personal data[15].
They will be held accountable for engaging a sub-processor without authorization, as Section 29(1)(e)[16] obligates the Data Processor to inform the Data Controller where a new processor is engaged.
The Data Processor will be directly liable to the Data Controller or authorities where they act outside the instructions given to them, as Section 29(2)[17] provides for a written agreement, which they ought to abide by.
A Data Controller or Processor of Major Importance is identifiable by the number of data they process. The NDPC Guidance Notice[18] provides that:
A DCPMI processes the personal data of more than 200 data subjects in 6 months.
They carry out commercial Information Communication Technology (ICT) services on any digital device which has storage capacity for personal data and belongs to another individual.
They don’t process personal data excluded by Section 3.
The obligations of Data Controllers and Processors provided in Section 29[19] also apply to them.
The categories of persons or organizations that act as Data Controllers
“Traders or artisans who do not transmit personal data as a trade or business object to other Data Controllers or Processors that may process the transmitted personal data for their business goals. E.g., a furniture maker, fashion designer, electrician, auto mechanic, market vendor, store owner, etc. There are instances where the Data Controller transmits the personal data to a Data Processor; such a controller remains a Data Controller and has to abide by the provisions of the NDPA.
Traders with less than fifteen (15) employees, or artisans who do not keep any specific filing system of personal data relating to their customers except routine phone contacts files, receipts data, contact addresses, and electronic mail addresses.
A Community of Friends, Professionals, or People of Common Interest who interact on Social Media Platforms”[20].
Other examples include schools, hotels and hospitality establishments, independent medical laboratories, employers, etc.
Data Processors in Nigeria include: Cloud Service & Web Hosting Providers, Payment Processors & Payment Gateway Services, HR & Payroll Software Platforms, Digital Marketing, Analytics & CRM Vendors, Logistics & Courier Services, etc.
Examples of DCPMIs in Nigeria
Commercial banks operating at national or regional level; Telecommunication companies; Insurance companies; Multinational companies; Electricity distribution companies; Ministries, Departments and Agencies (MDAs) of government; Micro Finance Banks; Higher Institutions; Hospitals providing tertiary or secondary medical services; Mortgage Banks;
Primary and Secondary Schools; Corporate Training Service Providers; Primary Health Centres; Independent Medical Laboratories; Hotels and Guest Houses with less than fifty (50) suites, etc[21].
In the case of Emmanuel Harunna v NDPC[22], the applicant claimed that the requirement of his personal information for registration was a breach of his privacy under Section 37 of the CFRN, and that POS agents are neither processors nor DCPMIs, relying on the definition in Section 65 of the NDPA.
The court held that the Nigeria Data Protection Commission (NDPC) acts lawfully within its statutory authority under the Nigeria Data Protection Act (NDPA) when designating POS operators as Data Controllers and Processors of Major Importance (DCPMIs). The Court also held that requiring POS agents to submit basic personal data for registration serves a legitimate public interest in protecting financial data subjects, does not violate constitutional privacy rights, and reflects the true, non-passive role agents play in processing transactional consumer data.[23]
Also, in Frank Ijege v. NDPC[24], the applicant challenged the NDPC’s original Guidance Notice.
The Court invalidated several provisions of the notice for exceeding the statutory scope of the NDPA specifically rejecting the NDPC’s attempt to classify entities as DCPMIs solely based on having “fiduciary relationships” or standard business-client interactions. Consequently, the Court ordered the NDPC to clearly define which entities are exempted or not of major importance before enforcing mandatory registration, prompting the NDPC to update its regulatory framework.[25]
A Data Controller bears primary obligations to the data subjects, is directly liable for breaches of personal data and data subjects’ damages, and must compulsorily be registered upon meeting the requirements of a DCPMI.
Whereas, a Data Processor bears contractual duties as provided in the written agreement between himself and the Data Controller, and also duties as provided in the NDPA; he’s primarily liable to the Controller and has to be registered if it’s a major processor.
Conclusion
[1] Nigeria Data Protection Regulation 2019.
[2] National Information Technology Development Agency Act 2007.
[3] National Data Protection Act 2023.
[4] Section 65, Nigeria Data Protection Act, 2023.
[5] Ibid.
[6] Ibid.
[7] Nigeria Data Protection Commission (NDPC), Guidance Notice on the Registration of Data Controllers and Data Processors of Major Importance, NDPC/HQ/GN/VOL.02./24 (2024).
[8] Nigeria Data Protection Act General Application and Implementation Directive (GAID), 2025.
[9] Section 24, Nigeria Data Protection Act 2023.
[10] Section 27, Nigeria Data Protection Act 2023.
[11] Section 28(1), Nigeria Data Protection Act 2023.
[12] Section 40(2), Nigeria Data Protection Act 2023.
[13] Section 51(1) and 24(3), Nigeria Data Protection Act 2023.
[14] Section 29(2), Nigeria Data Protection Act 2023.
[15] Section 29(1)(a – d );39(1), Nigeria Data Protection Act 2023.
[16] Section 29(1)(e), Nigeria Data Protection Act 2023.
[17] Section 29 (2), Nigeria Data Protection Act 2023.
[18] Nigeria Data Protection Commission (NDPC), Guidance Notice on the Registration of Data Controllers and Data Processors of Major Importance, NDPC/HQ/GN/VOL.02./24 (2024).
[19] Section 29, Nigeria Data Protection Act 2023.
[20] Nigeria Data Protection Commission (NDPC), Guidance Notice on the Registration of Data Controllers and Data Processors of Major Importance, NDPC/HQ/GN/VOL.02./24 (2024).
[21] Ibid .
[22] Emmanuel Haruna v. Nigeria Data Protection Commission (Unreported), Suit No. FHC/L/CS/1116/2024.
[23] Timothy Ogele, ‘Data Protection Compliance: Federal High Court Upholds NDPC’s Power to Designate and Register Entities as DCPMIs’ (Aluko & Oyebode, 12 August 2026) accessed 13 September 2026.
[24] Frank Ijege v. Nigeria Data Protection Commission (FHC/KD/CS/34/2024).
[25] Ogele (n 23).
CONTRIBUTORS
OJIENOH SEGUN JUSTICE, ESQ.,
LEAD PARTNER, EKO SOLICITORS AND ADVOCATES
OLABOYE MARVELLOUS ADEBANKE
INTERN, EKO SOLICITORS AND ADVOCATES
data controllers and processors,data controllers and processors,data controllers and processors,data controllers and processors,data controllers and processors,