Organizations in Nigeria designated as Data Controllers and Processors of Major Importance (DCMI/DPMI) are required to register with the Nigeria Data Protection Commission (NDPC). The registration is mandated by the Nigeria Data Protection Act (NDPA) of 2023.
Who qualifies as a DCMI or DPMI
The NDPC’s Guidance Notice specifies the criteria for determining if an organization qualifies as a DCMI or DPMI. Your organization must register if it operates in Nigeria and meets any of the following conditions:
- Processes data volume: Processes the personal data of more than 200 data subjects within a six-month period.
- Serves major sectors: Processes personal data as a provider in critical sectors, including:
- Financial services (e.g., banks, insurance)
- Communications
- Health and education
- Aviation, tourism, and hospitality
- Oil and gas, and electric power
- E-commerce, export, and import
- Provides commercial ICT services: Offers commercial Information Communication Technology (ICT) services on digital devices with storage capacity that belong to another individual.
- Maintains a fiduciary relationship: Holds a confidential relationship with data subjects, where the misuse of their data could cause significant harm.
Registration tiers and fees
The NDPC outlines registration tiers for DCMIs/DPMIs based on data processing volume and nature. These include Major Data Processing at Ultra-High, Extra-High, and Ordinary High Levels, each with different processing thresholds and fees ranging from ₦10,000 to ₦250,000.
How to register
Registration is done through the NDPC’s online portal, involving an application form, document uploads, fee payment, and submission. NOTE: you must contact a DPCO.. read other articles on DPCO
Consequences of non-compliance
Failing to register by the deadline violates the NDPA and may result in penalties, including fines upto 10million Naira
