Overview
The Federal High Court delivered a significant judgment in Frank Ijege v Nigeria Data Protection Commission (NDPC), striking down several provisions of the NDPC's 2024 Guidance Notice on registering data controllers and processors. The Court held that certain paragraphs of the Notice exceeded the Commission's powers under the Nigeria Data Protection Act, 2023, and were therefore null and void.
The judgment has immediate implications. Data controllers and processors who fall within the classes now revoked by the Court are exempt from registration, pending any appeal. The NDPC may also need to issue a revised Guidance Notice that specifies the classes of entities exempted from compliance, as required under the NDPA.
This insight examines the background to the case, the specific provisions struck down, the Court's rationale, and the practical effects of the judgment on Nigeria's data protection landscape. It also considers what stakeholders should do next as the regulatory framework continues to evolve.
