Data Controller vs Data Processor in Nigeria: Roles, Responsibilities and Examples

A hotel collects guests' names and contact details, then stores reservations in an outsourced booking platform. A retailer sends delivery addresses to a courier. A school relies on cloud software to maintain student records. In each case, several organisations may touch the same personal information—but they do not necessarily have the same legal role.

The distinction between a data controller and a data processor sits at the centre of Nigeria's data protection framework. Getting it wrong can lead to misleading privacy notices, weak supplier contracts, unresolved requests from customers and delayed responses to breaches. Under the Nigeria Data Protection Act, 2023 and the General Application and Implementation Directive (GAID) 2025 , the key question is not who owns the server: it is who decides the purpose and essential means of processing each set of personal data.

This guide explains the roles, how they overlap, and the responsibilities of Nigerian businesses and technology providers in 2026. It includes practical examples involving online shops, hospitality, schools, payment providers and SaaS applications. Research verified 2 November 2026; the examples are illustrative and should be assessed against actual agreements and processing activities.

1. What is a data controller under Nigerian law?

Section 65 of the NDP Act defines a data controller as a person or body that, alone or jointly with others, determines the purposes and means of processing personal data. Put simply, the controller decides why the information is needed and the essential features of what will be done with it.

Consider a small online store that decides to collect customers' names, phone numbers and addresses to process purchases. The store selects which fields appear at checkout and how long relevant order details should be retained. For those order activities, the store will typically be a controller even if its database runs on someone else's cloud infrastructure.

A controller must identify an appropriate lawful basis, provide transparent privacy information, respect individual rights and implement appropriate safeguards. Section 24 of the Act imposes privacy principles and accountability duties, while Section 27 concerns information provided to individuals. A controller cannot avoid those responsibilities by simply saying that its software vendor handles the data.

2. What is a data processor?

Section 65 defines a data processor as a person or organisation processing personal data on behalf of or at the direction of a controller or another processor. A processor commonly supplies the technology or operational service used to fulfil a purpose set by another organisation.

Examples can include a contracted hosting provider storing customer records, a payroll bureau processing an employer's staff file, or an outsourced support company answering customer enquiries under the merchant's instructions. A service provider is not automatically a processor for every activity: its independent purposes, legal duties and discretion must be assessed separately.

The processor must safeguard the information and comply with relevant instructions and statutory obligations. Section 29 requires appropriate technical and organisational measures, assistance with data-subject rights and compliance information, and notification when another processor is engaged. GAID Article 34 also sets out detailed requirements for the written Data Processing Agreement.

3. Controller vs processor: Side-by-side comparison

These categories are not rankings. A processor is not legally irrelevant, and a controller does not necessarily operate all the physical infrastructure. Both have duties under the Act; the allocation of practical tasks should be documented.

4. Who is the data subject?

The third important term is data subject: the individual whose personal information is being processed. In a hotel booking, the guest is a data subject; in a school information system, a student or parent may be the data subject; in employee payroll, staff are data subjects.

The business handling the information must distinguish its own commercial data from information about identifiable individuals. A booking ID may also be personal data if it can be tied to a guest. Not every document or item of company financial information is automatically personal data, but apparently anonymous identifiers can become personal when linked with other records.

5. Real Nigerian examples: Who is the controller?

Online shop, payment gateway and delivery company

An online shop will normally determine why it collects customer contact details and order histories, making it a controller for that processing. A courier acting solely on documented dispatch instructions may be a processor for that activity. But a delivery company deciding independently how to use customer information for its own account, fraud prevention or legal duties may act as a separate controller for those specific purposes.

A payment gateway's role is not safe to label universally as 'processor'. A gateway may process merchant instructions for some functions while making independent decisions for regulatory compliance, fraud, customer disputes or transaction records. The actual role depends on the service and applicable law—not the mere fact that it appears as an integration in checkout.

Hotels and hospitality-management platforms

A hotel that decides to collect guest identities, reservation dates, room preferences and payment information is typically the controller of those guest records. A contracted hospitality platform may act as processor while storing and organising bookings on the hotel's instructions. However, if the technology company separately decides to analyse identified guests across clients for its own marketing, it needs an independent legal assessment and cannot assume the hotel's instructions cover that use.

Schools and cloud reporting systems

A school sets the purposes for collecting student, parent and academic records. Its hosted school-management platform may be processor for the student-record service, subject to a written agreement. If a software provider wants to use student data to develop unrelated commercial products, that is a distinct processing purpose requiring appropriate assessment—particularly because children's information and other sensitive records can create elevated risks.

Employer and payroll bureau

An employer decides why employee payroll information is processed and what is required for salaries and statutory records. A contracted payroll bureau may be processor for payroll preparation. But an organisation that independently processes information to meet its own legal duties may be a controller for those activities. The relationship should be mapped by purpose, not assigned one label to every transaction.

6. Can one company be both a controller and a processor?

Yes. The law defines roles by the actual processing. A Nigerian SaaS company may be a controller for information about its own employees, subscribers and billing contacts while acting as a processor for customers' operational databases hosted on its platform.

The same organisation may change roles across different datasets or purposes without changing its company name. A single generic privacy-policy sentence saying 'we are only a processor' may therefore be incomplete. Create a processing register for each purpose, identifying the controller, processor, lawful basis, recipients and security responsibilities.

A useful practical test is to ask: Who decided this data should be collected? Who defined the intended use? Who can authorise a different purpose or retention period? Who has the authority to instruct another vendor? These questions are more revealing than whose name appears on the invoice for the hosting bill.

7. What are joint controllers?

Because the Section 65 definition covers organisations determining purposes and means jointly, two or more organisations can be joint controllers for a particular activity. For example, two companies might jointly design a shared customer loyalty programme and decide together how participating customers' information will be used.

Joint control does not arise merely because two businesses receive the same file. A courier and a merchant are not automatically joint controllers, and an ordinary controller–processor contract should not be relabelled as joint control without understanding how decisions are made.

Where joint control exists, businesses should document who provides the privacy information, who responds to rights requests and how they manage security and complaints. Their arrangement cannot remove individuals' statutory rights or erase accountability under the Act.

8. Responsibilities of a controller in 2026

• Maintain a record of data categories, purposes, lawful bases, recipients, locations and retention decisions.
• Provide clear privacy information and valid consent choices where consent is required.
• Limit collection and retention to justified purposes, and respect the applicable rights of data subjects.
• Choose processors carefully and establish appropriate written processing agreements.
• Ensure security and access controls are appropriate to the risks.
• Assess high-risk activities and undertake a Data Privacy Impact Assessment where required.
• Escalate and evaluate breaches, including NDPC notification within the applicable time limit.
• Check whether its activities qualify it for NDPC registration and additional major-importance duties.

GAID Articles 7, 15–19 and 27–34 provide further operational requirements. A controller should keep evidence of what it actually does, not just a policy copied from another organisation. FlyingEze's post-CAC registration guide also addresses organising business records and protecting customer information.

9. Responsibilities of a processor in 2026

• Operate within the documented, lawful scope of its engagement rather than using customer records for unrelated purposes.
• Implement proportionate security, confidentiality and access controls.
• Help the engaging controller or processor honour applicable rights requests.
• Supply evidence reasonably needed to demonstrate compliance.
• Notify the engaging party of new sub-processors under the applicable arrangements.
• Escalate suspected breaches to the engaging party promptly and support investigation.
• Review cross-border hosting, subcontractors, deletion and return-of-data processes.
• Assess its own DCPMI registration and other duties instead of assuming its clients' status automatically covers it.

Processors should train personnel, restrict access to client data and preserve relevant audit records. The Act and GAID impose direct responsibilities on processors; a contractual clause declaring the processor 'not responsible for privacy' is not a substitute for law.

10. What a Data Processing Agreement must include

Section 29(2) of the NDP Act requires a written agreement in the controller–processor or processor–subprocessor relationship. GAID Article 34 specifies detailed terms. A commercial Service Level Agreement (SLA) may support the arrangement, but a generic uptime guarantee does not necessarily supply all processing terms.

The GAID also expressly addresses potential risks, indemnity, insurance, tenure and other contractual matters. The DPA must reflect the actual services and data flow. A template with empty placeholders or inaccurate statements about data locations does not provide meaningful protection. Obtain appropriate legal review for high-risk processing.

11. What happens when a processor hires a sub-processor?

A sub-processor is another service provider engaged to perform part of the processing service. For example, a Nigerian software company may host merchant information with a cloud infrastructure vendor and send transactional emails through another provider. The first company should document the onward chain, including which data is accessible and under what instructions.

Section 29 requires the engaging party to ensure appropriate safeguards and notification when a new processor is engaged. The DPA should describe how new vendors are approved or notified, what information is provided and how equivalent obligations are imposed. Do not simply say 'all third parties are our responsibility' without a way to monitor the chain.

12. Who reports a personal-data breach?

Section 40 of the Act distinguishes processor escalation from the controller's regulatory notification. A processor must notify the controller or relevant engaging processor when it becomes aware of a breach. A controller must notify the Nigeria Data Protection Commission within 72 hours of becoming aware of a breach likely to risk the rights and freedoms of individuals. High-risk incidents also trigger duties to communicate promptly with affected individuals.

If a cloud vendor detects unauthorised access to hotel guests' contact details, it should promptly notify its customer through an established incident channel. The hotel must then assess whether NDPC notification or communication to affected guests is required. Neither party should assume that the other will magically discover the incident from a dashboard alert.

The GAID's Article 33 expands on breach notifications and content. Businesses should retain a record of events, investigation, containment and decisions, including when reporting is not required. FlyingEze's report on an NDPC investigation into an alleged CAC breach provides public context but does not establish a finding of liability.

13. Registration is not identical to being a controller

Every company handling personal data is not automatically required to register with NDPC as a Data Controller or Processor of Major Importance (DCPMI). NDPC has published risk- and category-based registration guidance, reflected in GAID Articles 8–10 and Schedule 7. Some organisations fall within Ultra-High, Extra-High or Ordinary-High classifications, while qualifying small traders may be outside those major-importance categories.

Being a processor is not an exemption from registration when the processor itself meets the designation criteria. Equally, a small controller need not automatically file an annual Compliance Audit Return merely because it maintains customer contacts. The NDPC FAQs explain distinctions, including some OHL registration-renewal cases that do not require CAR. Assess the actual organisation against current guidance.

14. Assess SaaS and business management products realistically

A hotel using outsourced accounting or property-management software should map roles before signing the contract. P-Biz Solutions publicly describes accounting functions such as receivables and reconciliation. That makes vendor data-handling questions relevant for businesses evaluating such a service, but it does not establish a particular NDPA role, accreditation or completed compliance audit for P-Biz Solutions. Ask for the actual service's DPA, sub-processor list, storage locations and security commitments.

Similarly, KudiScope describes local-first personal and business money tracking rather than acting as a bank. Its specific controller or processor obligations depend on the personal data it actually collects and the purposes of each feature. This is an example of why platform labels and marketing descriptions cannot replace a real data-flow assessment. No NDPC certification or legal role is asserted here for either company.

15. A practical role-assessment checklist for Nigerian businesses

1. List each activity involving identifiable customer, employee, student or guest information.
2. Identify who determines its purpose and essential methods: this points towards the controller role.
3. List outside companies that perform the activity only under another party's instructions.
4. Document services where either party uses the data for an independent purpose; assess those purposes separately.
5. Check any shared purposes that may create joint-control responsibilities.
6. Create or update written DPAs with processors and relevant sub-processors.
7. Review lawful bases, notices, technical controls, retention and cross-border access.
8. Assign responsibility for rights requests, complaints and security-incident escalation.
9. Assess DCPMI classification independently for each organisation.
10. Reassess the map when introducing new analytics, advertising, AI, CRM or cloud features.

A useful role register should contain the system name, data categories, controller identity, processor identity, sub-processors, purposes, processing location, legal basis, retention and incident contact. Maintain it as operations change rather than filing it away after onboarding.

Frequently asked questions

Is a business that owns the database always the controller?

No. Ownership of the server or database is not the legal test. The central question is who determines the purpose and essential means of processing the personal information.

Can a Nigerian SaaS company be both controller and processor?

Yes. It may control its own employee and subscription records while processing customer databases on its customers' behalf. Each activity must be assessed independently.

Is a payment gateway always a processor?

No. A payment provider may have different roles for merchant instructions, fraud prevention, regulatory duties and records. Review the actual service, agreement and statutory obligations.

Do processors need a written agreement?

Section 29 and GAID Article 34 provide for a written Data Processing Agreement covering the relevant processing relationship. A standard software subscription invoice is not a substitute for appropriate DPA terms.

Does a data processor have to register with NDPC?

It may, if the organisation falls within the NDPC's designated major-importance categories. It should not assume the controller's registration replaces its own applicable duties.

Conclusion

Under Nigeria's data protection law, the difference between controller and processor is about decision-making and instructions, not about which company has the biggest servers. Controllers decide the purposes and essential means of processing. Processors carry out processing on behalf of another party and have their own obligations to protect information.

For SMEs and technology providers in 2026, the practical goal is a documented role map supported by honest privacy notices, appropriate Data Processing Agreements, secure systems and a workable breach-response process. Roles can differ across transactions, so review the facts rather than relying on job titles or vendor marketing language.