Nigeria’s Point of Sale agents just lost a legal battle. A Federal High Court ruling has confirmed that the country’s roughly 2 million PoS agents, running about 5.9 million terminals nationwide, are legally classified as Data Controllers and Processors of Major Importance. This falls under the Nigeria Data Protection Act 2023. It applies whether the agents agreed to it or not.
YOU MAY READ ALSO:7 Nigerian Fintechs Make 2026 CNBC-Statista List.
The judgment came from a case titled Emmanuel Harunna v. Nigeria Data Protection Commission. The applicant asked the court to declare that PoS agents should not fall under the Nigeria Data Protection Commission’s registration rules. Justice F.N. Ogazi threw out the challenge. The judge ruled that the NDPC acted well within its statutory powers when it placed PoS agents in the Major Data Processing category at the Ordinary High Level. The court also found something important. Requiring registration does not violate constitutional privacy rights. Instead, it reinforces them by placing data processors under proper oversight, according to Technext24.
Following the verdict, NDPC National Commissioner Vincent Olatunji acted fast. He instructed every unregistered data controller and processor of major importance to comply without delay. He also warned that ignoring the requirement now carries real legal consequences.
So why does this matter so much? The answer comes down to what happens at every PoS terminal in the country. Every time an agent processes a transfer, they handle a customer’s account number, bank verification number, and transaction history. Often, they collect biometric details too. Multiply that across nearly 6 million terminals and you get a staggering volume of sensitive financial data. Most of it moves through hands that, until now, operated outside any formal data protection structure.
That new status comes with real obligations. Registered data controllers must have a lawful basis for processing personal information. They must put technical safeguards in place to prevent breaches. They must respond to customer requests about their own data. They must also keep detailed records of their processing activities and report any breach to the NDPC within a set timeframe. These are rules built for organisations with compliance departments and legal teams. They were not built for a trader running a single terminal out of a small kiosk.
Now, about the fee itself. The NDPC operates a tiered structure. Ultra High Level processors pay N250,000 to register. Extra High Level processors pay N100,000. Ordinary High Level, the category most PoS agents now fall under, costs N10,000. The Commission has pitched this lower tier as a way to ease compliance for smaller operators caught up in high risk data processing. On paper, N10,000 sounds manageable. But in practice, it lands differently. For an agent already squeezed by bank charges, network fees, and the daily grind of managing float in a cash strapped economy, this is another unplanned cost.
The court also leaned on Section 65 of the NDPA. This section gives the Act overriding authority over any conflicting law on data protection matters. As a result, it cements the NDPC’s position across every sector. This ruling did not happen in isolation either. It arrives as the Commission tightens enforcement across the board. Earlier this year, the NDPC secured a judgment that saw GTCO ordered to pay N250,000 in damages for sending unsolicited marketing messages. That case proved data protection breaches now carry real financial weight in Nigerian courts.
Still, the ruling leaves one big gap: awareness. Nigeria’s PoS network grew fast under the Central Bank’s financial inclusion push. Agents were trained mainly on handling cash, processing transactions, and spotting fraud. Nobody trained them on data protection law. Many agents in places like Onitsha, Kano, or Yenagoa likely have no idea a court just made them legally responsible data controllers overnight. They probably don’t know that registering with the NDPC is no longer optional.
The NDPC now has the legal backing it wanted, and the court has settled the matter for good. But one question remains open. Will the Commission follow this ruling with real outreach and education for agents at the bottom of the financial system? Or will it simply move straight to enforcement? The answer will decide whether this judgment genuinely strengthens data protection in Nigeria, or just adds one more burden to an already stretched informal economy.
