Cybersecurity law & regulation in Nigeria (2026)

Legal framework

Cybercrimes (Prohibition, Prevention, etc.) Act 2015, as amended by the Cybercrimes (Amendment) Act 2024, operationalized through the National Cybersecurity Policy and Strategy 2021, the Office of the National Security Adviser (ONSA) Directorate of Cybersecurity, and the Nigerian Computer Emergency Response Team (ngCERT). Sector-specific rules supplement it, notably the Central Bank of Nigeria's risk-based cybersecurity framework and breach-notification duties under the Nigeria Data Protection Act 2023.

Key points: cybersecurity in Nigeria

1. 01Primary comprehensive law

   The Cybercrimes (Prohibition, Prevention, etc.) Act 2015 is Nigeria's central cybersecurity/cybercrime statute, amended in 2024 (signed 28 February 2024) to revise 12 sections, strengthen ngCERT's role, increase penalties and expand surveillance/interception powers.

   cert.gov.ng mondaq.com

2. 02Incident reporting to ngCERT (72 hours)

   Section 21 requires any person/institution that observes an attack, intrusion or disruption to report it to the National CERT (ngCERT). The 2024 amendment cut the reporting window from 7 days to 72 hours; the prior regime carried a fine and possible denial of internet service for failure to report.

   cert.gov.ng techhiveadvisory.africa

3. 03Critical National Information Infrastructure (CNII)

   Part II of the Act empowers designation of CNII and prescribes minimum standards, guidelines and procedures for its protection, preservation and management, with audit and inspection powers.

   cert.gov.ng coe.int

4. 04National strategy & coordination bodies

   The National Cybersecurity Policy and Strategy 2021 sets governance direction; the ONSA Directorate of Cybersecurity is the lead agency, and ngCERT is the national coordination centre managing incidents and overseeing sectoral CSIRTs.

   cert.gov.ng cert.gov.ng

5. 05Cybersecurity levy and National Cybersecurity Fund

   Section 44 of the Act establishes a National Cybersecurity Fund; to implement it the Central Bank issued a circular requiring banks/financial institutions to apply a 0.5% levy on electronic transactions.

   mondaq.com hamulegal.com

6. 06Sectoral rules, CBN financial sector

   The Central Bank of Nigeria's Risk-Based Cybersecurity Framework and Guidelines (for Deposit Money Banks/Payment Service Banks and, since 2022, Other Financial Institutions) mandate governance, monitoring and reporting of all cyber incidents to the Director of Banking Supervision within 24 hours of detection.

   cbn.gov.ng aluko-oyebode.com

7. 07Data-breach notification (NDPA 2023)

   Under the Nigeria Data Protection Act 2023, controllers must notify the Nigeria Data Protection Commission of personal-data breaches (within 72 hours where feasible) and affected individuals where risk is high; processors must promptly notify the engaging controller.

   iclg.com fpf.org

Timeline of decisions

1. 1 Dec 2024Enforcement
   EFCC Raids Cybercriminal Syndicate; ~800 Arrested Including Foreign Nationals

   Nigeria's Economic and Financial Crimes Commission conducted its largest single cyber-enforcement sweep, detaining nearly 800 people and subsequently arraigning 42 Chinese and Filipino nationals in February 2025 on charges of cryptocurrency investment fraud and romance scams, signalling intensified cross-border enforcement cooperation.

   Dark Reading

2. 31 May 2024Guidance · official
   CBN Issues Risk-Based Cybersecurity Framework for Deposit Money Banks and Payment Service Banks

   The Central Bank of Nigeria published a binding framework applicable to all commercial, merchant, non-interest, and payment service banks, setting minimum requirements for cybersecurity governance, annual risk assessments, third-party risk management, AI and cloud-technology controls, and mandatory incident reporting, with a compliance deadline of 1 July 2024.

   Central Bank of Nigeria (CBN)

3. 28 Feb 2024Law · official
   Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act 2024 Signed

   President Tinubu signed amendments to the 2015 Cybercrime Act expanding surveillance powers, allowing security agencies to intercept communications without a court order in 'urgent' cases, extending telecom data-retention obligations, criminalising 'false or misleading' online posts, and imposing a 72-hour cyber-incident reporting duty. Civil-society groups warned the broad speech provisions risk being weaponised against journalists and activists.

   ngCERT / Federal Government of Nigeria

4. 28 Feb 2024Law · official
   Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act 2024 Signed into Law

   President Tinubu signed the Amendment Act, revising 12 sections of the 2015 statute: reducing incident reporting to 72 hours, mandating sectoral CERTs and SOCs, raising the cybersecurity levy on electronic transactions from 0.005% to 0.5% (subsequently suspended by presidential directive in May 2024 after public outcry), and adding offences covering technology-facilitated gender-based violence.

   WIPO Lex / Federal Government of Nigeria

5. 29 Jun 2022Guidance
   CBN Issues Risk-Based Cybersecurity Framework for Other Financial Institutions

   The CBN extended mandatory cybersecurity governance to microfinance banks, mortgage institutions, finance companies, and other non-bank financial institutions, requiring formal cybersecurity programmes, incident monitoring and reporting, and compliance by 1 January 2023, closing a major gap in sectoral coverage left by the banks-focused 2021 framework.

   Aluko & Oyebode (reporting CBN circular)

6. 1 Jan 2021Guidance · official
   National Cybersecurity Policy and Strategy (NCPS) 2021 Published

   Nigeria's Office of the National Security Adviser published the NCPS 2021, designating 13 critical information infrastructure sectors, confirming ONSA as the national cybersecurity coordinator, mandating ngCERT as the central incident response body, and setting a five-year strategic roadmap covering cyber governance, defence capability, legal reform, and international cooperation.

   ngCERT / Office of the National Security Adviser (ONSA)

7. 15 May 2015Law · official
   Cybercrimes (Prohibition, Prevention, etc.) Act 2015 Enacted, Nigeria's Foundational Cybercrime Law

   Nigeria enacted its first comprehensive cybercrime statute, criminalising hacking, identity theft, cyberstalking, computer fraud, and phishing; requiring financial institutions and service providers to implement baseline cybersecurity measures; establishing ngCERT; and introducing a 0.005% cybersecurity levy on electronic transactions to fund the National Cybersecurity Fund.

   ngCERT / Federal Government of Nigeria

8. 1 Jan 2007Law · official
   NITDA Act 2007 Establishes Nigeria's IT Regulatory Authority

   The National Information Technology Development Agency Act created NITDA with authority to develop standards, guidelines, and regulations for IT systems, data governance, and cybersecurity, the statutory foundation that later empowered NITDA to issue the NDPR 2019 and the entire data-protection compliance regime.

   NITDA

Sources

1. 1.cert.gov.ng/ngcert/resources/CyberCrime__Prohibition_Prevention_etc__Act__2024.pd
2. 2.cert.gov.ng/ngcert/resources/CyberCrime__Prohibition_Prevention_etc__Act__2015.pd
3. 3.cert.gov.ng/ngcert/resources/NATIONAL_CYBERSECURITY_POLICY_AND_STRATEGY_2021.pdf
4. 4.cert.gov.ng/
5. 5.cbn.gov.ng/Out/2024/BSD/CBN%20Risk-Based%20Cybersecurity%20Framework%20for%20DMB
6. 6.aluko-oyebode.com/insights/cbn-issues-the-risk-based-cybersecurity-framework-and-guidel
7. 7.iclg.com/practice-areas/data-protection-laws-and-regulations/nigeria
8. 8.fpf.org/blog/nigerias-new-data-protection-act-explained/
9. 9.mondaq.com/nigeria/security/1701826/the-cybercrime-prohibition-prevention-etc-am
10. 10.techhiveadvisory.africa/insights/nigeria-cybercrimes-prohibition-prevention-etc-act-amendment
11. 11.coe.int/en/web/octopus/country-wiki-ap/-/asset_publisher/CmDb7M4RGb4Z/content
12. 12.hamulegal.com/highlights-of-cybercrimes-prohibition-prevention-etc-amendment-act-20