Introduction
The rapid advancement of digital technology has transformed business operations, financial transactions, communication and service delivery in Nigeria. However, increased dependence on digital platforms has also exposed individuals, businesses and government institutions to cybersecurity threats, including hacking, identity theft, ransomware attacks, financial fraud and unauthorised disclosure of personal information.
In response to these challenges, Nigeria has developed a legal and regulatory framework aimed at protecting information systems, preventing cybercrime and safeguarding personal data. In 2026, cybersecurity and data protection compliance are no longer matters of corporate discretion but essential legal and governance responsibilities. This update examines the principal laws governing cybersecurity and data protection in Nigeria and highlights the obligations imposed on organisations operating within the country.
The Legal Framework Governing Cybersecurity in Nigeria
The Cybercrimes (Prohibition, Prevention, etc.) Act 2015 (as amended)
The Cybercrimes Act 2015 is Nigeria’s principal legislation addressing cyber-related offences. It establishes offences and penalties relating to unauthorised access to computer systems, unlawful interception of electronic communications, identity theft, computer-related fraud, cyberstalking and other activities involving the unlawful use of digital technologies.
The legislation also provides a framework for investigating and prosecuting cybercrime and protecting critical information infrastructure. Its provisions are particularly relevant to financial institutions, telecommunications companies, technology businesses and organisations that maintain significant digital infrastructure.
The Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act 2024 introduced further changes to the principal legislation, including amendments relating to cybersecurity coordination and the National Cybersecurity Fund. It also provides for a cybersecurity levy applicable to specified electronic transactions and categories of businesses, subject to the relevant statutory provisions.
Consequently, organisations must understand the scope of their obligations under the amended legislation and implement appropriate safeguards against cyber threats.
The Nigeria Data Protection Act 2023
The Nigeria Data Protection Act 2023 (NDPA) is the principal legislation regulating the processing of personal data in Nigeria. It was enacted on 12 June 2023 and established the Nigeria Data Protection Commission (NDPC) as the regulatory authority responsible for administering and enforcing data protection obligations.
The Act applies to organisations processing personal data within Nigeria and, in specified circumstances, organisations outside Nigeria processing the personal data of individuals in Nigeria.
The NDPA establishes fundamental data protection principles, including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability. These principles require organisations to collect and process personal information responsibly, transparently and for legitimate purposes.
The Act also recognises the rights of data subjects, including the rights to access personal information, request correction or erasure, object to certain processing activities, restrict processing and obtain personal data in a portable format, subject to applicable statutory conditions.
Importantly, organisations must identify a lawful basis for processing personal data. Consent is one available basis, but processing may also be justified by contractual necessity, legal obligations, legitimate interests and other recognised grounds under the Act.
Other Relevant Regulatory Instruments
Nigeria’s cybersecurity and data protection framework is supported by additional legislation and regulatory instruments.
These include the Constitution of the Federal Republic of Nigeria 1999 (as amended), particularly section 37, which guarantees the privacy of citizens, their homes, correspondence and telephone conversations.
The Nigerian Communications Act 2003 provides the regulatory framework for the telecommunications sector, while the National Information Technology Development Agency Act 2007 establishes NITDA’s statutory responsibilities concerning information technology development and regulation.
Furthermore, the Designation and Protection of Critical National Information Infrastructure Order 2024 strengthens the framework for identifying and protecting information infrastructure essential to national security, economic stability and public welfare.
The NDPA General Application and Implementation Directive (GAID) 2025 also provides important implementation guidance for organisations subject to the NDPA. It addresses matters including regulatory registration, compliance audits, data protection officers and international transfers of personal data.
Data Protection Compliance Obligations for Nigerian Businesses
Organisations collecting, storing or processing personal information must adopt appropriate compliance measures under the NDPA and applicable regulatory directives.
First, businesses should conduct data audits to establish the categories of personal information collected, the purposes of processing, storage arrangements and third parties with whom information is shared.
Second, organisations qualifying as Data Controllers or Data Processors of Major Importance must register with the NDPC in accordance with applicable requirements.
Third, organisations must implement appropriate technical and organisational security measures to protect personal information against unauthorised access, alteration, disclosure, destruction or loss. Such measures may include encryption, access restrictions, multi-factor authentication, secure backups and employee cybersecurity training.
Fourth, organisations must appoint a Data Protection Officer where required by the Act and applicable directives. The officer is responsible for overseeing data protection compliance and advising the organisation on its statutory obligations.
Fifth, Data Protection Impact Assessments (DPIAs) should be conducted where proposed processing activities are likely to create high risks to the rights and freedoms of individuals.
Additionally, organisations engaging external service providers to process personal data must establish appropriate contractual arrangements defining the parties’ respective responsibilities, confidentiality obligations and security requirements.
Where personal data is transferred outside Nigeria, organisations must also comply with the international transfer requirements prescribed under the NDPA.
Data Breaches, Reporting and Regulatory Sanctions
A data breach may expose an organisation to substantial financial, legal and reputational consequences. The NDPA therefore imposes specific breach notification obligations.
Where a personal data breach is likely to result in a risk to individuals’ rights and freedoms, the data controller must notify the NDPC within 72 hours of becoming aware of the breach, where reasonably practicable. Where the breach is likely to result in a high risk to affected individuals, the controller must also communicate the breach to the affected data subjects without undue delay.
Organisations should consequently maintain effective incident response procedures to facilitate prompt identification, investigation, containment and reporting of security incidents.
The NDPC has enforcement powers under the Act, including the authority to investigate non-compliance, issue enforcement directives and impose administrative sanctions. Under section 48, the maximum remedial fee for a Data Controller or Data Processor of Major Importance is the greater of ₦10 million or 2% of its preceding financial year’s annual gross revenue. For other controllers and processors, the applicable maximum is the greater of ₦2 million or 2% of annual gross revenue.
Non-compliance may also result in compensation claims, regulatory investigations, reputational damage and disruption of business operations.
Practical Recommendations for Organisations in 2026
Nigerian businesses should adopt a proactive approach to cybersecurity and data protection compliance. This includes conducting regular cybersecurity assessments, reviewing privacy policies, implementing access controls, training employees and monitoring information systems for suspicious activities.
Organisations should also maintain records of processing activities, establish procedures for responding to data subject requests and periodically review their contractual arrangements with third-party processors.
Businesses operating in regulated industries, particularly banking, telecommunications and healthcare, should pay additional attention to sector-specific regulatory requirements.
Conclusion
Nigeria’s cybersecurity and data protection framework has developed considerably, placing increased responsibility on organisations that collect, process, store or transmit personal information.
The Cybercrimes Act, as amended, the NDPA 2023, the GAID 2025 and relevant sector-specific regulations collectively establish important legal obligations for businesses operating within Nigeria.
In 2026, cybersecurity and data protection should be treated as essential components of corporate governance rather than mere regulatory formalities. Organisations that invest in appropriate legal compliance structures, technological safeguards and responsible data management practices will be better positioned to minimise cyber risks, avoid regulatory sanctions and maintain public confidence in an increasingly digital economy.
Please note that this material is not legal advice. For professional support, please reach out to info@coventlegal.com