The Evolving Landscape Of Digital Law And Cybercrime In Nigeria

1. Introduction:

The rapid advancement of technology has profoundly reshaped every facet of human interaction, including commerce, communication, and even criminality. Nigeria, a nation with a burgeoning digital economy and a high rate of internet penetration, has been particularly impacted by this transformation. Consequently, its legal framework has had to rapidly evolve to keep pace with the complex challenges posed by cybercrime and the need to regulate digital activities.  The dawn of the digital age has brought with it unprecedented opportunities for growth, innovation, and connectivity. However, it has also opened new frontiers for illicit activities, giving rise to sophisticated forms of cybercrime. Nigeria, often referred to as Africa’s largest economy and most populous nation, has embraced digital transformation with enthusiasm. This embrace, while beneficial, has simultaneously exposed its citizens and institutions to the pervasive threat of cyber-attacks, fraud, and data breaches. In response, the Nigerian legal system has embarked on a dynamic journey to establish robust frameworks that deter digital criminality, protect online rights, and foster a secure digital environment. This article delves into the contemporary state of digital law in Nigeria, assessing the progress made and the hurdles that remain. Further, it explores the trajectory of digital law in Nigeria, focusing on key legislative instruments such as the Cybercrime Act and the Nigeria Data Protection Act, examining their effectiveness, identifying persistent challenges, and highlighting emerging issues like the legal implications of Artificial Intelligence (AI) and blockchain technology.

2. Cybercrime Act and its Evolution

The cornerstone of Nigeria’s digital law enforcement efforts is the Cybercrime (Prohibition, Prevention, Etc.) Act, 2015 (the “Cybercrime Act”)[1]. Enacted to provide a comprehensive legal, regulatory, and institutional framework, the Act sought to address a wide array of cyber-related offenses, including hacking, unauthorized access, online fraud, identity theft, cyberstalking, and cyberterrorism[2]. It also made provisions for the protection of Critical National Information Infrastructure (CNII) and imposed obligations on service providers to preserve traffic and subscriber information, as well as report cyber threats[3].

While the 2015 Act was a monumental step, the ever-evolving nature of cybercrime necessitated continuous review. Recent amendments, such as those introduced in the Cybercrimes (Amendment) Act 2024, aim to strengthen the legal framework further. Key changes include heavier penalties for cybercrimes like hacking and online fraud, stricter punishments for unauthorized cryptocurrency transactions, and increased liability for social media platforms failing to remove “offensive” content promptly[4]. These amendments underscore Nigeria’s commitment to adapting its laws to the fluid cyber threat landscape. However, the effectiveness of the Act continues to be debated, with challenges such as weak enforcement, jurisdictional complexities, and limited technical expertise often cited as hindrances to its full impact[5].

3. The Nigeria Data Protection Act

Beyond prosecuting cybercrime, a critical aspect of digital law involves safeguarding personal data. Nigeria’s journey in data protection gained significant momentum with the issuance of the Nigeria Data Protection Regulation (NDPR) 2019 by the National Information Technology Development Agency (NITDA). The NDPR was pioneering in its aim to protect the rights of persons to privacy, foster safe conduct for data transactions, and prevent personal data manipulation[6]. It introduced a compliance model involving Data Protection Compliance Organizations (DPCOs) and mandated data audit reports from data controllers and processors[7].

Building on the NDPR’s foundation, the Nigeria Data Protection Act (NDPA) 2023 was enacted, elevating data protection to a statutory level and establishing the Nigeria Data Protection Commission (NDPC) as an independent supervisory authority[8]. The NDPA retains many principles of the NDPR, including lawful bases for processing personal data, and introduces enhanced safeguards for children’s data[9]. The Act empowers the NDPC to issue guidelines, investigate breaches, and impose penalties for violations, with significant fines stipulated for non-compliance[10]. The NDPA is a crucial step towards ensuring data privacy rights and enhancing data security, aligning Nigeria more closely with international best practices.

4. Data Sovereignty and Privacy: The Nigeria Data Protection Act

Complementing the cybercrime framework is Nigeria’s progressive stance on data privacy. The Nigeria Data Protection Regulation (NDPR) 2019, issued by NITDA, was an initial, groundbreaking step towards establishing a legal basis for personal data protection[11]. It introduced principles of lawful processing, mandated data audits, and laid the groundwork for a data protection compliance ecosystem.

Building upon the NDPR’s foundation, the Nigeria Data Protection Act (NDPA) 2023 was signed into law, effectively elevating data protection to a statutory level and establishing the independent Nigeria Data Protection Commission (NDPC)[12]. The NDPA aligns Nigeria with global data protection standards by affirming data subjects’ rights, outlining principles for data processing (including consent, lawful purpose, and data minimization), and stipulating obligations for data controllers and processors. Crucially, it provides enhanced safeguards for sensitive personal data, including that of children, and outlines stringent requirements for cross-border data transfers[13]. The NDPA also introduces significant penalties for non-compliance, empowering the NDPC to impose fines and ensure accountability for data breaches[14]. While the NDPA is a comprehensive and commendable effort, its long-term effectiveness will depend on the NDPC’s operational independence, its capacity to enforce compliance across diverse sectors, and the level of public awareness regarding data rights.

5. Emerging Frontiers: AI, Blockchain, and the Law

The advent of cutting-edge technologies like Artificial Intelligence (AI) and blockchain presents novel legal questions for Nigeria. AI’s pervasive application, from automated decision-making to content generation, raises concerns about data privacy, intellectual property rights, and accountability. The NDPA, for instance, restricts the exclusive use of automated decision-making processes that have significant effects on data subjects[15]. Furthermore, Nigeria’s Copyright Act 2022 plays a role in governing AI’s use, particularly regarding intellectual property. However, it currently attributes authorship to human creators, creating ambiguity for AI-generated works and raising questions about copyright ownership and potential infringement when AI systems are trained on copyrighted material[16]. This necessitates a re-evaluation of existing IP frameworks to clarify ownership structures and address the unique challenges posed by AI.

Blockchain technology, underpinning cryptocurrencies and decentralized systems, introduces complexities related to digital assets, smart contracts, and regulatory oversight. While the Cybercrime Act 2024 includes provisions for unauthorized cryptocurrency transactions, the broader legal implications of blockchain’s use in various sectors, from finance to supply chain management, are still evolving. Issues such as the legal enforceability of smart contracts, the jurisdiction in decentralized networks, and regulatory approaches to digital currencies and NFTs require dedicated legal frameworks or clear interpretations of existing laws.

6. Challenges

Despite significant legislative strides, Nigeria’s digital law landscape faces several persistent challenges. Nigeria’s cyber and digital laws face several challenges, including inadequate enforcement, outdated legislation, lack of awareness, and jurisdictional issues. These challenges hinder the effective prosecution of cybercrimes and the protection of digital rights.

1. Inadequate Enforcement: Effective enforcement of digital laws requires specialized technical expertise, adequate funding for law enforcement agencies, and robust inter-agency coordination. [17]Capacity building for legal professionals, judges, and law enforcement is crucial to navigate the complexities of digital evidence and cyber investigations.

• Weak digital forensic capabilities make it difficult to investigate and prosecute cybercrimes.
• Lack of specialized personnel and resources for law enforcement agencies to handle cybercrime cases.
• Inconsistent implementation and enforcement of existing cybercrime laws.

2. Outdated Legislation:

• Cybercrime laws, like the Cybercrimes Act of 2015, may not adequately address the rapidly evolving nature of cyber threats.
• Legislation needs to be updated to include emerging technologies like cryptocurrency and AI.

3. Lack of Awareness: A significant portion of the population lacks adequate digital literacy, making them vulnerable to cyber threats and unaware of their digital rights. Public awareness campaigns and educational initiatives are vital to foster a cybersecurity-conscious society.[18]

• Many individuals and businesses are unaware of their digital rights and responsibilities.
• Insufficient cybersecurity awareness contributes to vulnerabilities and risks.

4. Jurisdictional Issues: The transnational nature of cybercrime often presents jurisdictional challenges, requiring international cooperation and mutual legal assistance treaties to bring offenders to justice.

• Cybercrimes often involve cross-border transactions, making it challenging to identify, prosecute, and extradite offenders.
• Cooperation between countries is crucial for effective cybercrime investigations and prosecutions.

5. Insufficient Penalties:

• The penalties prescribed for cybercrimes may not be severe enough to deter offenders.
• Inconsistent application of penalties can also undermine the effectiveness of the legal framework.

6. Data Privacy Concerns:

• Evolving data privacy regulations in Nigeria raise concerns about the protection of personal information online.
• Ensuring informed consent and transparency in data collection, especially with IoT devices, remains a challenge.

7. Capacity Building and Training:

• There’s a need for ongoing training and capacity building for law enforcement, prosecutors, and judges to handle cybercrime cases effectively.
• Strengthening the capacity of cybersecurity professionals is also crucial.

8. Coordination among Stakeholders:

• Effective collaboration and coordination among government agencies, law enforcement, and the private sector is essential.
• Sharing of cyber threat intelligence and best practices is vital for a coordinated response to cyber threats.

9. Balancing Security and Rights: Striking a delicate balance between national security concerns and individual digital rights, particularly regarding freedom of speech and privacy, remains a critical challenge. Debates surrounding internet shutdowns and the use of surveillance technologies highlight the need for clear legal safeguards and accountability mechanisms¹⁵.
10. Rapid Technological Pace: The speed at which technology evolves often outstrips the pace of legislative development, leading to potential legal gaps. A proactive and adaptive legislative approach is essential.

 

7. Way forward/Recommendations

a. Strengthening Cybersecurity Policies and Enforcement – The Nigerian government should enhance the enforcement of cybersecurity laws and introduce stringent compliance requirements for businesses and organizations.

b. Investing in Cybersecurity Education and Workforce Development – More universities should offer specialized cybersecurity courses, and government-led training programs should be implemented.

c. Enhancing Public Awareness Campaigns – Awareness initiatives should educate individuals and businesses on safe online practices and threat mitigation strategies.[19]

d. Adopting Advanced Security Technologies – Organizations should implement advanced cybersecurity tools such as artificial intelligence (AI)-driven threat detection, encryption, and multi-factor authentication.

e. Developing a National Cybersecurity Strategy – A unified national cybersecurity strategy with collaboration between government agencies, the private sector, and international partners is essential for improving Nigeria’s cyber resilience

 

Conclusion

Nigeria’s commitment to building a robust digital economy is mirrored by its evolving legal framework to combat cybercrime and protect data privacy. The Cybercrime Act and the Nigeria Data Protection Act represent significant milestones in this journey. However, the rapidly shifting technological landscape, coupled with persistent implementation and enforcement challenges, demands a proactive and adaptive approach. Strategic investments in human capital development, widespread digital literacy initiatives, enhanced international cooperation, and the development of clear regulatory frameworks for emerging technologies like AI and blockchain will be crucial. By addressing these imperatives, Nigeria can not only safeguard its digital space but also unlock the full potential of its digital economy for sustainable national development.

Cybersecurity remains a critical challenge for Nigeria as the country continues its digital transformation. The increasing frequency and sophistication of cyberattacks pose significant risks to businesses, government institutions, and individual users. Despite existing regulatory efforts, weak enforcement, a lack of cybersecurity awareness, and a shortage of skilled professionals continue to hinder Nigeria’s ability to combat cyber threats effectively. Addressing these challenges requires a multi-faceted approach, including strengthening cybersecurity policies, increasing investments in education and workforce development, and implementing advanced security technologies. Collaboration between government agencies, private sector organizations, and international partners will be essential in developing a more resilient cybersecurity framework. Furthermore, enhancing public awareness and adopting proactive security measures will help mitigate risks and ensure the protection of critical infrastructure and sensitive data. By prioritizing cybersecurity, Nigeria can foster a secure digital ecosystem, encourage foreign investments, and sustain economic growth in the digital era. The future of Nigeria’s cybersecurity landscape will depend on a strategic and coordinated effort to address vulnerabilities and build a more resilient cybersecurity infrastructure.

[1] Cybercrime (Prohibition, Prevention, Etc.) Act, 2015, Laws of the Federation of Nigeria (LFN) 2015

[2] See, generally, Sections 5, 22, 23, 24 of the Cybercrime (Prohibition, Prevention, Etc.) Act, 2015.

[3] Templars Law Firm, “The Reach and Impacts of the Cybercrime Act, 2015 on Digital Transactions in Nigeria,” (undated), available at https://www.templars-law.com/app/uploads/2018/07/The-Reach-and-Impacts-of-the-Cybercrime-Act-2015.pdf.

[4] NALTF, “Nigeria’s Cybercrime Reform,” (May 22, 2025), available at https://naltf.gov.ng/nigerias-cybercrime-reform/.

[5] ResearchGate, “Cybercrime Legislation in Nigeria: Effectiveness and Gaps,” (February 5, 2025), available at https://www.researchgate.net/

[6] National Information Technology Development Agency (NITDA), “Nigeria Data Protection Regulation (NDPR) 2019.”

[7] NITDA, “Nigeria Data Protection Regulation 2019: Implementation Framework,” (January 2021), available at https://nitda.gov.ng/wp-content/uploads/2021/01/NDPR-Implementation-Framework.pdf.

[8] Nigeria Data Protection Act, 2023.

[9] S.P.A. Ajibade & Co., “A REVIEW OF THE NIGERIA DATA PROTECTION ACT”

[10] ibid

[11] National Information Technology Development Agency (NITDA), “Nigeria Data Protection Regulation (NDPR) 2019.”

[12] Nigeria Data Protection Act, 2023.

[13] S.P.A. Ajibade & Co., “A REVIEW OF THE NIGERIA DATA PROTECTION ACT 2023,” (undated), available at https://spaajibade.com/a-review-of-the-nigeria-data-protection-act-2023/.

[14] Copyright Act, 2022.

[15] AELEX Legal, “REGULATING ARTIFICIAL INTELLIGENCE IN NIGERIA,” (July 1, 2024), available at https://www.aelex.com/regulating-artificial-intelligence-in-nigeria/.

[16] Alliance Law Firm, “Copyright in the Age of Artificial Intelligence (AI): Legal Implications and Emerging Issues,” (undated), available at https://alliancelawfirm.ng/copyright-in-the-age-of-artificial-intelligence-ai-legal-implications-and-emerging-issues/.

[17] ResearchGate, “The Evolution of Cybercrime in Nigeria: Trends and Countermeasures,” (February 5, 2025), available at https://www.researchgate.net/publication/388634325_The_Evolution_of_Cybercrime_in_Nigeria_Trends_and_Countermeasures

[18] Bridgewater State University Virtual Commons, “Emerging Trends in Cybercrime Awareness in Nigeria,” (November 1, 2022), available at https://vc.bridgew.edu/cgi/viewcontent.cgi?article=1098&context=ijcic.

[19] Isaac, O. (2025). Evaluating Cybersecurity Risks in Nigeria ’ s Commercial Banking Sector : An Empirical Analysis.