Register controllers/processors of major importance with Commission
Under Nigeria Data Protection Act, 2023
Overview
A controller or processor of major importance must register with the Commission under section 44(1), providing the detailed notification information under section 44(2). Imported research notes (check before approving): • Duty holders (any one of): data controller; data processor • Goes to: regulator (Nigeria Data Protection Commission) • Applies when: Act commencement for existing major-importance entities OR entity becomes of major importance • Timing in the source: "within six months after the commencement of the Act or on becoming a data controller or data processor of major importance" • Timing is flagged as ambiguous: The six-month phrase is tied to commencement, followed by “or on becoming” a major-importance entity; the Act does not explicitly say six months after becoming. Preserve both anchors and require legal review. • Exception: Commission may exempt classes of major-importance controllers or processors from section 44 registration when unnecessary or disproportionate. • Flagged by the research: The six-month phrase is tied to commencement, followed by “or on becoming” a major-importance entity; the Act does not explicitly say six months after becoming. Preserve both anchors and require legal review. • Further quotation: "This Act shall not apply to the processing of personal data carried out by one or more persons solely for personal or household purposes" (Section 3) • Further quotation: "This Act shall apply, where the — (a) data controller or data processor is domiciled in, resident in, or operating in Nigeria ; (b) processing of personal data occurs within Nigeria ; or (c) the data controller or the data processor is not domiciled in, resident in, or operating in Nigeria, but is processing personal data of a data subject in Nigeria." (Section 2) • Further quotation: "The Commission may exempt a class of data controllers or data processors of major importance" (Section 44)
Important
This requirement was extracted from the source document. Applicability depends on your organization's circumstances. Review the official source and obtain professional advice where appropriate.
Key information
- Jurisdiction
- Nigeria
- Obligation type
- Registration
- Frequency
- Event-based
- Suggested owner
- Data Protection Officer
- Suggested priority
- High
- Policy categories
- Data Protection, Cybersecurity, Privacy
- Source
- Section 44, Section 44, page 29
- Policy last reviewed
- Oct 23, 2026
Details
Who this may apply to
Controllers and processors of major importance (defined in section 65; thresholds/designations prescribed by Commission); subject to class exemptions under section 44(6). Condition (review): Controller or processor with the statutory duty in this record. Logic to review: Section 3(1) excludes solely personal/household processing unless that processing violates the data subject’s fundamental right to privacy. Logic to review: Section 2(2) gives three OR alternatives: controller/processor domicile, residence or operations in Nigeria; processing in Nigeria; or a foreign controller/processor processing personal data of a data subject in Nigeria. The rule engine must not replace this with an inaccurate AND requirement.
- May apply if: Data controller/processor must meet the statutory major-importance classification; class thresholds/designation set by Commission.
When this applies
Event-based · within six months after the commencement of the Act or on becoming a data controller or data processor of major importance — exact deadline not calculated
From the source
“shall register with the Commission within six months after the commencement of the Act or on becoming a data controller or data processor of major importance.”
Section 44, Section 44, page 29
Other obligations in this policy
Explore other identified requirements from the same source policy.
Remindash provides this information to help organizations identify and track potential obligations. Applicability can depend on your organization's circumstances. Review official sources and obtain professional advice where appropriate.