Which Sectors Are Legally Required to Register With the NDPC in Nigeria?

When the Nigeria Data Protection Commission was established under the NDPA 2023, it was given a clear mandate: regulate the collection, storage, processing, and use of personal data across Nigeria, and hold organisations accountable to those standards.

Central to that accountability is the requirement for certain categories of organisations to formally register with the NDPC. This registration is not a voluntary certification. It is a statutory obligation, one that carries real consequences for the businesses that fall within its scope and fail to comply.

The challenge is that many of those businesses do not know they are in scope.

This article sets out clearly which sectors the NDPA identifies as requiring mandatory NDPC registration, what the obligation means in practical terms, and what steps organisations in those sectors need to take.

Understanding the Registration Obligation

Under the NDPA, organisations that qualify as data controllers or data processors of major importance are required to register with the NDPC. The Act defines these as organisations that process personal data on a large scale, process particularly sensitive categories of data, or process data in ways that could significantly affect the rights and freedoms of data subjects.

The NDPC has the authority to designate sectors and organisations that meet this threshold, and it has done so with increasing specificity as its enforcement capacity has grown.

The key question for any business is not "is my company large enough to matter?" but rather "does the nature and volume of data we handle bring us within the statutory definition?"

For many organisations across multiple sectors, the answer is yes.

The Sectors Required to Register

1. Banking and Financial Services: This is the most extensively regulated sector under the NDPA's registration framework, and for obvious reasons. Banks, microfinance institutions, insurance companies, pension fund administrators, mortgage institutions, and fintech platforms all process personal and financial data at enormous scale — account details, transaction histories, biometric data, BVN records, credit information, and more. The sensitivity and volume of this data, combined with the potential consequences of its misuse, places every significant player in this sector firmly within the mandatory registration requirement. NDPC enforcement activity has already been most concentrated here.
2. Telecommunications: Mobile network operators, internet service providers, and VoIP platform operators process subscriber data at a scale that few other sectors can match: call records, location data, messaging metadata, identity verification data, and usage patterns for millions of Nigerians. The registration obligation applies across this sector, with the understanding that communication data carries particular sensitivity given what it can reveal about individuals' private lives, relationships, and behaviours.
3. Healthcare: Hospitals, clinics, diagnostic laboratories, pharmacies, health insurance providers, telemedicine platforms, and digital health applications handle some of the most sensitive personal data in existence: medical histories, diagnoses, prescriptions, mental health records, reproductive health data, and in some cases genetic information. The NDPA treats health data as a special category requiring heightened protection. Any healthcare organisation processing this data at meaningful scale is within the registration scope. This includes the rapidly growing Nigerian health technology sector, where patient data is frequently processed across multiple digital platforms and third-party systems.
4. Education: Educational institutions collect and store extensive personal data about their students names, ages, home addresses, academic records, financial information, disciplinary records, family details, and in the case of younger students, information about parents and guardians. Universities, polytechnics, secondary schools, primary schools, and EdTech platforms are all within scope where they process this data at significant scale. The registration obligation applies to both traditional educational institutions and the growing ecosystem of digital learning platforms operating in Nigeria.
5. E-Commerce and Retail: Online marketplaces, retail platforms, and e-commerce businesses collect customer personal data, purchase histories, payment card details, delivery addresses, browsing behaviour, and device identifiers at a scale that brings them firmly within the registration requirement. The growth of Nigerian e-commerce has outpaced the regulatory awareness of many operators in this space. Many platform operators are processing millions of customer records without the compliance infrastructure the NDPA requires.
6. Government and Public Sector: The NDPA's registration and compliance requirements are not limited to the private sector. Federal and state government agencies, parastatals, and public institutions that process citizen data on any significant scale are subject to the same obligations. This includes agencies managing national identity systems, tax records, voter information, social benefit data, and any other large-scale citizen datasets. The public sector's data practices are squarely within the NDPC's regulatory mandate.
7. Human Resources, Staffing, and Recruitment: HR technology platforms, recruitment agencies, professional employer organisations, and payroll service providers process personal data about employees and job candidates, CVs, identity documents, salary information, performance records, disciplinary histories, and in some cases health and background check data. Where this processing occurs at scale as it does for any significant HR tech platform or recruitment firm operating nationally, the registration obligation applies.
8. Data and Technology Companies: Organisations whose primary business is the processing of personal data on behalf of other organisations occupy a particularly clear position within the NDPA's framework. Cloud storage providers, data analytics firms, CRM vendors, marketing technology companies, and data centre operators are all squarely within scope as data processors. It is worth noting that the registration obligation can apply to both the organisation that collects the data (the data controller) and the organisation that processes it on the controller's behalf (the data processor). Many technology companies that have assumed they are outside the regulatory perimeter because they do not "own" the data are in fact fully within it.
9. Other Regulated Sectors: Beyond these primary categories, the NDPC's registration framework extends to other sectors where personal data processing carries significant risk or scale. These include real estate platforms handling property transaction and tenant data, credit bureaux processing financial and behavioural data, legal services firms managing client data at significant scale, and any sector-specific regulated industry whose licensees handle personal data in volume.

How to Know If Your Organisation Qualifies

The NDPA does not provide a simple subscriber count or revenue threshold that determines registration eligibility. The assessment is based on the nature, volume, and sensitivity of the data processed, and the potential impact on data subjects.

A practical self-assessment involves asking:

Does your organisation collect and process personal data about a large number of individuals, customers, patients, students, employees, or citizens? Does the data you process fall into sensitive categories: health information, financial data, biometric data, children's data? Does your organisation process personal data on behalf of other organisations as a core part of your business model? Would a failure or breach in your data systems have significant consequences for the individuals whose data you hold?

If the answer to any of these questions is yes, a formal assessment of your registration obligation is warranted. In most cases, organisations in the sectors listed above will find that the obligation applies.

The Consequences of Non-Registration

Operating without NDPC registration, where registration is required, is itself a violation of the NDPA; independent of any other compliance gap your organisation may have.

The consequences of non-registration can include regulatory fines, enforcement orders, mandatory compliance audits, restrictions on data processing activities, and in serious cases, public naming by the NDPC. The reputational and commercial consequences of a public enforcement action frequently exceed the direct financial penalties.

There is also the commercial dimension. Enterprise clients and international partners increasingly require evidence of NDPC registration before entering into contracts or data sharing arrangements. Investors conducting due diligence flag unregistered status as a regulatory risk. The compliance gap that feels manageable today becomes an active obstacle to growth as your business scales.

Starting the Registration Process

NDPC registration requires organisations to submit documentation about their data processing activities: what data they collect, the purpose of processing, the legal basis for processing, how long data is retained, and the security measures in place to protect it.

For many organisations, completing this accurately requires a prior compliance gap assessment to understand their current data practices and identify what documentation needs to be created or updated. Working with a licensed Data Protection Compliance Organisation (DPCO) typically makes this process significantly faster and ensures the submission is accurate and complete.

The Straightforward Question

If your organisation operates in any of the sectors described in this article, the most useful thing this piece can do is prompt one clear question:

Are you registered with the NDPC?

If the answer is no, or if you are not certain, that clarity is worth pursuing before the NDPC pursues it instead.

Accuvice Solutions Limited is a licensed Data Protection Compliance Organisation (DPCO) helping Nigerian businesses understand their NDPA obligations, complete their NDPC registration, and build compliance frameworks that protect their organisations and their clients.

Contact us at https://www.accuvice.ng/contact#booking to book a free compliance conversation.