As highlighted in the publication – An Overview of The Nigeria Data Protection Act 2023, one of the key provisions of the Nigeria Data Protection Act (NDPA or Act) is the introduction of a new classification of data controllers and processors i.e., “Data Controllers and Data Processors of major importance” (DCPMI) and the compulsory registration obligations with the Nigeria Data Protection Commission (the NDPC or Commission) where they meet the threshold/benchmark for such registration.
In this legal alert, we have attempted to highlight this key provision and what it may mean for businesses.
Who is a Data Controller and Data Processor of Major Importance
Data controller or data processor of major importance, under the Act, is a controller or processor that is domiciled, resident in or operating in Nigeria and processes or intends to process personal data of more than such number of data subjects who are within Nigeria, as the Commission may prescribe, or such other class of data controller or processor that is processing personal data of particular value or significance to the economy, society or security of Nigeria as the Commission may designate.
Registration and other Regulatory Compliance Requirements
The Commission has not prescribed the number or provided guidance on the type of data that will qualify as data of particular value or significance. We anticipate in the coming weeks that the Commission will provide the relevant threshold/benchmark, any data controller/processor that falls within the threshold will be required to register and comply with other regulatory requirements.
Apart from the need to register, DCPMI are required to appoint Data Protection Officer (DPO) who may be an employee of the data controller/processor or engaged by a service contract. This will need to be read in conjunction with the list of entities that are required to appoint DPO under the Nigeria Data Protection Regulation (NDPR) Implementation Framework.
The NDPA also gives power to the NDPC to prescribe fees and levies to be paid by the DCPMI.
Data controller(s) and data processor(s) of major importance are required to register with the commission within six months after the commencement of the act or on becoming a data controller and data processor of major importance.
Click here to download and read the full alert.
--
Read the original publication at MWC Legal. .