PoS agents in Nigeria — about 2 million operators across roughly 5.9 million active terminals nationwide — are now legally classified as Data Controllers and Processors of Major Importance under the Nigeria Data Protection Act 2023.

The designation follows a Federal High Court ruling that has expanded Nigeria’s data protection compliance framework to cover one of the country’s largest informal financial networks. Under the ruling, PoS agents must register with the Nigeria Data Protection Commission (NDPC) or face legal liability.

The decision came in Emmanuel Harunna v. Nigeria Data Protection Commission, a case in which the applicant asked the court to declare that PoS agents fall outside the NDPC’s registration requirement.

Justice F.N. Ogazi of the Federal High Court dismissed the challenge, holding that the NDPC acted within its statutory powers when it designated PoS agents as DCPMIs under the classification of Major Data Processing at the Ordinary High Level. The court also said the registration requirement strengthens, rather than violates, constitutional privacy rights because it brings data processors under effective regulatory oversight.

Following the judgment, NDPC National Commissioner Vincent Olatunji directed all unregistered DCPMIs to comply immediately. The commission warned that failure to register creates serious legal liabilities under the law.

A PoS agent processing a bank transfer typically handles a customer’s account number, bank verification number, transaction history and, in many cases, biometric confirmation. Across 5.9 million terminals, that amounts to a very large volume of sensitive financial data processed daily by operators who have largely remained outside the formal data protection compliance structure since financial inclusion drove PoS adoption across the country.

These obligations were originally designed for organisations with compliance infrastructure. Most PoS agents are sole traders or micro-entrepreneurs working with a terminal, a phone and a float.

The NDPC registration framework classifies Major Data Processing into three levels with corresponding fees. Ultra High Level processing attracts a ₦250,000 registration fee. Extra High Level attracts ₦100,000. Ordinary High Level, the tier under which most PoS agents fall, attracts ₦10,000.

The commission has said the tiered structure is intended to promote ease of doing business for smaller organisations involved in high-risk data processing, and on paper the ₦10,000 fee is modest. For a PoS agent operating on transaction margins in a market already absorbing CBN charges, network fees and the cost of handling cash in an economy still dealing with liquidity pressures, however, it is another expense introduced without warning or preparation.

The NDPC’s 2024 Guidance Notice, which preceded the ruling, had already outlined the categories of organisations required to register as data controllers and processors in Nigeria, including organisations of particular value or significance to the economy, society or security of Nigeria as DCPMIs. PoS agents were included in that framework, but Emmanuel Harunna’s legal challenge created uncertainty over whether the designation would survive judicial review. Justice Ogazi’s ruling resolves that uncertainty.

The court held that Section 65 of the NDPA overrides any inconsistent law on data protection matters, reinforcing the Act’s supremacy across sectors.

The ruling comes as Nigeria’s data protection enforcement posture is becoming stricter. In recent months, the NDPC has increased enforcement against companies accused of unlawful data processing and cross-border data transfers. Olatunji has repeatedly described personal data as a strategic national asset in public remarks.

Earlier this year, the commission secured another notable ruling when a Federal High Court awarded ₦250,000 in damages against GTCO for sending unsolicited marketing messages to a non-customer, underscoring that data protection violations can carry direct financial consequences. The PoS ruling extends that enforcement approach to a sector that has processed sensitive financial data at scale for years with minimal regulatory oversight.

Nigeria’s PoS agent network grew rapidly under CBN financial inclusion targets, with agents recruited and trained mainly on transaction processing, cash management and customer-side fraud prevention. Data protection compliance was not part of that training.

Many PoS agents in places such as Onitsha, Kano or Yenagoa would not have known, the morning after the judgment, that a court had formalised their status as data controllers, that registration with the NDPC was now an immediate legal obligation, or that operating without registration exposed them to the liabilities the commission has warned about.

The NDPC now has the legal authority it sought, and the court has confirmed it. The compliance mandate now covers more than 2 million PoS agents and 5.9 million terminals.

The remaining question is whether the commission will pair enforcement with the outreach and education needed to make compliance achievable for operators at the bottom of the formal financial system. That will help determine whether the judgment strengthens data protection in Nigeria or simply adds a new liability to the country’s informal financial infrastructure without improving protection for the people it serves.