The Nigeria Data Protection Commission (NDPC) has announced an extension of the deadline for Data Controllers and Data Processors of Major Importance (DCPMIs) to register with the Commission. The new deadline for registration without penalty is October 31, 2024.
To ensure accountability and compliance with the Nigeria Data Protection Act (NDP Act), DCPMIs are now required to engage only registered agents and contractors for personal data processing. This measure aligns with sections 24(3), 29(1)(a), and 44 of the NDP Act.
Section 29(1)(a) of the NDP Act states: Where a data controller engages the services of a data processor or a data processor engages the services of another data processor, the data controller or data processor engaging another shall ensure that the engaged data processor — (a) complies with the principles and obligations set out in this Act as applicable to the data controller;
A data processor, as defined by Section 65 of the NDP Act, is any individual, entity, or body that processes personal data on behalf of a data controller.
The NDPC urges DCPMIs to promptly ensure that their agents and contractors are registered with the Commission. Failure to comply with this requirement can lead to violations of the NDP Act.