‘Sheep, Shepherd Responsibility': Data Controller, Data Processor And The NDPR 2019

Introduction

The passage of Nigerian Data Protection Regulation 2019 (NDPR) and the proactive steps thus far taken by the National Information Technology Development Agency (NITDA) has awakened the consciousness of the organisations and individuals to be NDPR compliant. The concepts/designations of Data Controller (DC) and Data Processor (DP) takes centre stage in the NDPR. This is because it determines who takes responsibility for compliance and the related liability as well. There is always lack of clarity between the two concepts vis-a-vis their roles. Sometimes, an organisation or person may perform the role of a DC and DP, such as where it processes personal data (PD) on behalf of another organisation (as processor), but is a controller for PD of its employee. However, no company or person can be a DC and DP for the same activity.¹