Court ruling mandates N10,000 license for Nigerian PoS agents – even without their consent

PoS agents, approximately 2 million of them operating across roughly 5.9 million active terminals nationwide, are now legally classified as Data Controllers and Processors of Major Importance under the Nigeria Data Protection Act 2023

This follows a Federal High Court ruling that has quietly expanded Nigeria’s data protection compliance framework to cover one of the country’s largest informal financial networks. They must register with the Nigeria Data Protection Commission (NDPC) or face legal liability.

The ruling came in Emmanuel Harunna v. Nigeria Data Protection Commission, a case in which the applicant sought a court declaration that PoS agents fall outside the NDPC’s registration requirement.

Justice F.N. Ogazi of the Federal High Court dismissed the challenge, finding that the NDPC acted within its statutory powers in designating PoS agents as DCPMIs under the classification of Major Data Processing at the Ordinary High Level. The court also held that the registration requirement strengthens rather than violates constitutional privacy rights by bringing data processors under effective regulatory oversight.

Following the judgement, NDPC National Commissioner Vincent Olatunji directed all unregistered DCPMIs to comply immediately, with the Commission warning that failure to register creates serious legal liabilities under the law.

What PoS agents do with your data every day

A PoS agent processing a bank transfer handles the customer’s account number, bank verification number, transaction history and in many cases, biometric confirmation.

Across 5.9 million terminals, this adds up to an enormous volume of sensitive financial data processed daily by operators who have largely existed outside the formal data protection compliance structure since financial inclusion drove PoS adoption across the country.

Under the NDPA 2023, a registered Data Controller and Processor of Major Importance carries specific legal obligations. They must establish a lawful basis for processing personal data. They must implement technical and organisational measures to protect that data from unauthorised access or breach. They must be able to respond to data subject access requests. They must maintain records of their processing activities. They must report data breaches to the NDPC within the timeframes prescribed by the Act.

These obligations were designed for organisations with compliance infrastructure. Most PoS agents are sole traders or micro-entrepreneurs operating with a terminal, a phone and a float.

The NDPC’s registration framework classifies Major Data Processing into three levels with corresponding fees.

• Ultra High Level processing attracts a ₦250,000 registration fee.
• Extra High Level attracts ₦100,000.
• Ordinary High Level, the tier under which most POS agents fall, attracts ₦10,000.

The Commission has described the tiered structure as fostering ease of doing business for smaller organisations involved in high-risk data processing, and on paper the ₦10,000 figure is modest.

For a PoS agent running on transaction margins in a market already absorbing CBN charges, network fees and the operational cost of managing cash in an economy still navigating liquidity pressures, it is one more cost arriving without warning or preparation.

The 2024 NDPC Guidance Notice that preceded this ruling had already detailed the categories of organisations required to register as data controllers and processors in Nigeria, identifying organisations of particular value or significance to the economy, society or security of Nigeria as DCPMIs.

PoS agents were included in that framework, but the legal challenge brought by Emmanuel Harunna created uncertainty about whether the designation would survive judicial scrutiny. Justice Ogazi’s ruling resolves that uncertainty. Section 65 of the NDPA, the court held, prevails over any inconsistent law on data protection matters, reinforcing the supremacy of the Act across sectors.

The ruling arrives at a moment when Nigeria’s data protection enforcement posture is visibly hardening. The NDPC has stepped up enforcement actions against companies accused of unlawful data processing and cross-border data transfers in recent months. Olatunji has described personal data as a strategic national asset on multiple public occasions.

The Commission secured a significant ruling earlier this year when a Federal High Court awarded ₦250,000 in damages against GTCO for sending unsolicited marketing messages to a non-customer, establishing that data protection violations carry tangible financial consequences. The PoS ruling extends that enforcement posture to a sector that has processed sensitive financial data at scale for years with minimal regulatory oversight.

The compliance gap the ruling leaves open

Nigeria’s PoS agent network expanded rapidly under CBN financial inclusion targets, with agents recruited and trained primarily on transaction processing, cash management and fraud prevention from the customer side.

Data protection compliance was not part of that training. The average PoS agent in Onitsha, Kano or Yenagoa who woke up the morning after this ruling was handed down had no knowledge that a court had just formalised their status as a data controller, that registration with the NDPC was now an immediate legal obligation, or that operating without that registration exposed them to the liabilities the Commission has warned about.

The NDPC has the legal authority it sought, and the court has confirmed it. The compliance mandate now covers over 2 million PoS agents and 5.9 million terminals.

Whether the Commission pairs enforcement with the kind of outreach and education that would make compliance achievable for operators at the bottom of the formal financial system is the question this ruling leaves open, and the answer will determine whether this judgement strengthens data protection in Nigeria or simply adds a new liability to the country’s informal financial infrastructure without improving the protection of the people it serves.