Nigeria’s Cybercrime Legal Framework: Key Provisions and Implications for Businesses

Introduction

Nigeria’s digital economy continues to expand, accompanied by increasing exposure to cybersecurity risks. In response, the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act 2024 was enacted to strengthen the earlier 2015 legislation.

The amendments introduce revised compliance requirements, broaden the scope of cyber-related offences, and enhance enforcement mechanisms. These changes are relevant to financial technology companies, small and medium-sized enterprises (SMEs), and individuals engaged in digital or online business activities.

Overview of the Amendment

The 2024 amendment seeks to:

• Strengthen cybersecurity governance and enforcement
• Expand the definition and coverage of cyber-related offences
• Improve incident reporting timelines
• Enhance coordination among regulatory and security agencies

Further legislative developments may occur as Nigeria continues to adapt its legal framework to emerging technologies.

Key Provisions

1. Incident Reporting Requirements

Organisations are required to report cybersecurity incidents to relevant authorities, including the national Computer Emergency Response Team, within a specified timeframe (generally within 72 hours of detection).

Failure to comply may result in penalties as prescribed by law.

2. Expansion of Cyber Offences

The scope of cyber-related offences has been extended to cover:

• Fraud involving digital and electronic systems
• Identity theft and impersonation across sectors
• Misuse of emerging payment technologies

These provisions apply to both public and private sector organisations.

3. Cybersecurity Levy

A levy is introduced on certain electronic transactions to support the National Cybersecurity Fund. The applicable rate and implementation are subject to regulatory guidelines.

Non-compliance may attract financial penalties and administrative sanctions.

4. Identity Verification Requirements

Financial institutions and other relevant entities are required to obtain and verify customer identification details, including National Identification Number (NIN) and Bank Verification Number (BVN), in line with Know-Your-Customer (KYC) regulations.

5. Data Retention and Privacy

Service providers are required to retain specified data for a defined period and cooperate with lawful requests from authorities, while complying with applicable data protection regulations.

6. Cyberstalking and Online Conduct

The amendment refines provisions relating to cyberstalking by focusing on harmful communications that involve threats to individuals, public safety, or order.

7. Institutional Framework

The law strengthens the role of national and sector-specific cybersecurity bodies, including coordination by the Office of the National Security Adviser and relevant response teams.

Implications for Businesses

Fintech and Financial Service Providers

• Establish internal processes for timely incident detection and reporting
• Ensure compliance with KYC and identity verification requirements
• Review systems handling electronic transactions and cybersecurity controls
• Maintain appropriate data governance and retention policies

Small and Medium-Sized Enterprises (SMEs)

Implement basic cybersecurity measures (e.g., secure access controls, data protection practices)

• Maintain proper records of digital transactions
• Understand reporting obligations in the event of a breach
• Consider the financial i

Digital and Social Media-Based Businesses

• Ensure that online communications comply with applicable laws
• Avoid dissemination of false or harmful information
• Protect customer data and respect privacy obligations
• Maintain internal policies for content and data management

Compliance Considerations

Businesses may consider the following steps:

• Conduct a review of existing cybersecurity policies and controls
• Establish incident response procedures aligned with reporting timelines
• Train staff on cybersecurity awareness and compliance obligations
• Ensure alignment with other applicable laws, including data protection regulations
• Maintain accurate documentation for audit and regulatory purposes

Future Outlook

There are ongoing discussions regarding further updates to Nigeria’s cybercrime framework, particularly in relation to:

• Emerging technologies such as artificial intelligence and digital assets
• Periodic review of penalties and enforcement mechanisms
• Strengthening collaboration between public and private sector stakeholders

Businesses are advised to monitor regulatory developments and adapt accordingly.

Conclusion

The Cybercrimes (Amendment) Act 2024 introduces important changes to Nigeria’s cybersecurity and regulatory landscape. While the provisions enhance protection against cyber threats, they also impose additional compliance responsibilities on organisations.

A structured approach to cybersecurity, data management, and regulatory compliance is essential for operating effectively within the evolving digital environment.

Frequently Asked Questions (FAQ)

Q1: What is the main objective of the amendment?
A: To strengthen Nigeria’s legal framework for preventing and addressing cyber-related offences.

Q2: Who is affected by the law?
A: The law applies to individuals, businesses, financial institutions, and service providers operating within Nigeria’s digital ecosystem.

Q3: What is the reporting timeline for cyber incidents?
A: Incidents are generally required to be reported within 72 hours of detection, subject to applicable regulations.

Q4: Does the law apply to small businesses?
A: Yes. The provisions apply broadly, although the extent of obligations may vary depending on the nature of operations.

Q5: Are there penalties for non-compliance?
A: Yes. Penalties may include fines and other sanctions as prescribed under the law.