POS agents are required to register with NDPC
POS agents in Nigeria are covered by the Nigeria Data Protection Commission’s registration framework. Before you apply, confirm your business’s category and the obligations that go with it. The NDPC’s registration guidance provides the basis for that assessment.
6030 Technologies can help you with registration. Complete our NDPC compliance assessment so we can review your business details. Once we have the required information and have completed the assessment, we will provide a detailed proposal with pricing for the work your business needs.
To speak with us first, email info@6030technologies.com or call +2349037692946.
POS registration NDPC Nigeria: who needs to register
NDPC registration concerns the business or person handling personal data. Section 44 of the Nigeria Data Protection Act 2023 requires data controllers and data processors of major importance, often called DCPMIs, to register with the Commission.
For POS agents, the issue has also been tested in court. In reports published on 28 July 2026, the NDPC said the Federal High Court had dismissed a challenge to its power to register POS agents as DCPMIs. The case was Emmanuel Harunna v. Nigeria Data Protection Commission. Nairametrics reported the Commission’s statement, including its direction that unregistered DCPMIs should register immediately.
The practical implication for a POS agent is that a small outlet or a single terminal should not be treated as proof of exemption. A shop accepting card payments and an agent providing withdrawals and transfers have different business activities. Assess each business’s processing and registration obligations on its own facts.
Describe what you actually do when seeking advice. Include the services you offer, the customer information you access, any records you retain and your relationship with the payment provider. The label “POS business” alone does not give the full picture.
NDPC registration, CAC registration and POS onboarding
| Requirement | What it covers |
|---|---|
| NDPC registration | Registration of qualifying data controllers and processors under Nigeria’s data protection framework. |
| CAC registration | The registration of your business name or company with the Corporate Affairs Commission. |
| Payment-provider onboarding | The provider’s process for appointing or onboarding you to offer its services, subject to applicable payment and agent banking rules. |
A CAC certificate or an active POS account does not, by itself, establish that your NDPC registration is complete. The agent banking rules described in the CBN’s regulatory updates govern a separate part of your operations.
An assessment and a detailed proposal for your POS business
6030 Technologies prepares pricing after assessing your business. We first review your POS operations, registration status and any compliance gaps that affect the work required.
Once we have the details we need and have completed that review, we will send you a detailed proposal. It will explain the recommended scope of work and the associated costs, including our professional fees and any applicable registration charges.
Submit the assessment form to get started. Our team may contact you for additional information before finalising your proposal.
NDPC registration requirements: what to prepare
For your assessment, gather the information below. This is a preparation checklist; the NDPC’s current application process determines the supporting documents required for your case.
- Your business name, address and contact details, with CAC registration information where applicable.
- The types of personal data you handle and the number of individuals concerned.
- Why you use that information and the organisations you share it with.
- The details of your Data Protection Officer (DPO), or the current status of that appointment.
- The service providers that process data for you and any relevant transfers outside Nigeria.
- A description of your security measures and any existing privacy notices or data protection records.
Section 44(2) of the Nigeria Data Protection Act sets out the statutory registration information. Use it to check for gaps before submitting your application.
Use categories and counts when describing customer information. Your initial enquiry should not contain customers’ card details, PINs or one-time passwords. If you have already registered, have your existing registration record available so the assessment can establish what remains to be done.
How to register a POS business with the NDPC
1. Confirm your role and registration category
Review the information you collect, access, store or share. Identify the legal entity or person responsible for the POS operation and establish whether it acts as a data controller, processor or both. A controller decides why and how personal data is processed; a processor acts on a controller’s behalf. Check the appropriate category against the NDPC’s guidance.
2. Prepare the application information
Bring together your business details and the information in the checklist above. Resolve inconsistent names, missing contact details and uncertainty about your processing activities. If you operate several outlets, describe the full business being assessed.
3. Use the official NDPC registration portal
The NDPC Information Management Portal provides the online registration route. Select the data controller/processor option for your business. The separate DPCO option is for organisations applying to provide data protection compliance services.
You can use the official portal yourself or engage a licensed DPCO to assist. Complete the applicable application and follow the portal’s payment instructions. Check the classification and payable charges before making payment.
4. Follow up and retain the registration record
Respond to any requests for clarification and keep copies of your submission and payment evidence. Retain the NDPC registration record or certificate when issued. A payment receipt alone should not be treated as confirmation that every compliance obligation has been met.
5. Plan for renewal and ongoing compliance
Set reminders for the obligations that apply to your category. Keep your business information accurate and review your compliance arrangements when the operation changes. If you already qualify for registration but have not registered, arrange an assessment promptly.
POS data protection compliance after registration
The NDPC’s General Application and Implementation Directive 2025, Article 9, distinguishes between categories:
- Ordinary High Level (OHL) businesses renew their registration annually and do not have to file an annual Compliance Audit Return (CAR) when they renew annually.
- Extra High Level (EHL) and Ultra High Level (UHL) businesses register once and file CARs annually.
You must also protect customer information in daily operations. The Act requires appropriate security measures. For a POS operation, practical measures to consider include:
- Limiting access to transaction records and protecting the devices used for business.
- Keeping receipts and customer records away from public view, with a retention schedule that reflects applicable obligations.
- Giving customers clear information about how their data is used and who they can contact.
- Training staff to recognise a data incident and report it through the appropriate provider and compliance channels.
These practical examples support the security duties in section 39 of the Act. The controls you need should match your operation and the information it handles.
Frequently asked questions
Is my payment provider’s NDPC registration enough?
Do not assume it covers your business. Ask what has been registered, under whose name, and whether your own obligations have been addressed. NDPC registration for POS agents needs to reflect the actual business and its processing arrangements.
How much will NDPC registration support cost?
We provide pricing in a detailed proposal after collecting the required business information and completing our assessment. The proposal covers the support your business needs, including our professional fees and applicable registration charges. Complete the assessment to start the process.
How long does NDPC registration take?
The time needed depends on the completeness of your information, any issues that need to be resolved and the NDPC’s processing of your application. We can discuss the expected work after assessment; approval timing remains with the Commission.
Can a small POS business be exempt?
Size alone does not establish an exemption. The updated guidance contains specific categories and exclusions, so your activities need to be checked against it. Do not assume that having fewer customers or using only one terminal settles the question.
Get help with your POS NDPC registration
6030 Technologies is listed as an active licensed Data Protection Compliance Organisation in the NDPC’s public DPCO directory. Our data protection compliance services include classification assessments, NDPC registration support and help with ongoing obligations.
Tell us how your POS business operates and what you need help with. Once we have the required details, we will complete the assessment and send you a detailed proposal setting out the work and pricing.
Start your NDPC compliance assessment
Prefer to talk first? Email info@6030technologies.com or call +2349037692946.
Regulatory information checked on 7 October 2026. Confirm current requirements when applying.