Introduction
In today’s digital economy, data has become the “new oil,” fueling innovation, commerce, and governance. While the increasing reliance on digital platforms, cloud computing and interconnected technologies has no doubt,created vast opportunities for efficiency and growth, it has equally exposed individuals, corporations, and states to significant cybersecurity risks, among which “data breaches” pose some of the gravest concern. A data breach whether through hacking, insider threats, or accidental disclosure, undermines not only consumer’s trust but also the legal obligations of organizations that process personal and corporate information.
Nigeria, Africa’s largest digital market, has not been insulated from this challenge. The country has witnessed a surge in cybercrimes ranging from data leaks to identity theft and financial fraud. According to the 2025 Africa Cyberthreat Assessment Report, Nigeria ranked among the top 10 countries most affected by cyberattacks in Africa.[1] This reality raises urgent questions about cybersecurity readiness and the adequacy of legal and regulatory frameworks as cybercrime continues to outpace the legal system designed to stop it.
The enactment of the Nigeria Data Protection Act, 2023 (NDPA) and the establishment of the Nigeria Data Protection Commission (NDPC) mark a watershed moment in Nigeria’s data governance landscape. Nevertheless, organizations continue to grapple with compliance requirements and potential liabilities as data breaches continue to raise critical questions about corporate accountability, individual remedies, and the adequacy of Nigeria’s cybersecurity laws when measured against international benchmarks.
This article examines the legal implications of data breaches in Nigeria, with a focus on constitutional guarantees, statutory provisions, regulatory enforcement, and international benchmarks.
What Constitutes Data Breach?
A data breach refers to a security violation in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen, or used by an unauthorized individual.[2] Nigeria’s Data Protection Act 2023 (NDPA) defines a data breach, referred to as a “personal data breach,” as a breach of security of a data controller or data processor that leads to or is likely to lead to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data that is transmitted, stored, or otherwise processed.[3]
Such breaches can be intentional (e.g., cyberattacks, hacking, or ransomware) or accidental (e.g., employee negligence, misdirected emails, or unsecured systems). Common forms include:
- Unauthorized access (hacking, phishing, social engineering).
- Insider misuse (employees leaking or exploiting data).
- Accidental disclosure (sending sensitive data to wrong recipients).
- Cyber extortion (ransomware attacks).
The types of data typically compromised in breaches include personally identifiable information (PII), financial records, health data, and corporate trade secrets all of which are legally protected under Nigerian law.
It is pertinent to note that Nigeria Data Protection Act (NDPA) distinguishes between a personal data breach and a broader security incident. Not all security incidents result in personal data breaches, as a breach requires actual or likely compromise of data confidentiality, integrity, or availability.
While the NDPA does not explicitly categorize data breaches, it is useful to understand breaches through three key principles of data security:
- Confidentiality Breach: This is an unauthorized or accidental disclosure or access to personal data without the consent or authority of the data subject. For example, an employee erroneously sends personal data to unauthorized recipients, or malicious actors access sensitive financial or health information.[4]
- Integrity Breach: This is an accidental or unauthorized alteration of personal data. An example would be the unauthorized modification of a patient’s health record or alteration of contact details that compromise security measures like two-factor authentication. This breach could be committed by a controller or a third party or hacker who comes in contact with personal data, alters it to suit his ulterior purpose before transmitting same to the intended recipient.[5]
- Availability Breach: This occurs when authorized persons are prevented from accessing data. It may arise from accidental or unlawful destruction, deletion, or loss of access to data. For instance, deletion from cloud storage, disruptions caused by ransomware attacks, or denial-of-service incidents resulting in data unavailability. Data inaccessibility may also stem from non-malicious causes, such as system downtime or network failures, which temporarily prevent access to personal data.[6]
Legal Framework Governing Data Protection and Cybersecurity in Nigeria
- The Constitution of the Federal Republic of Nigeria 1999, as amended
Privacy remains one of the most cherished values in modern democratic society, serving as a cornerstone for the protection of individual autonomy, dignity, and freedom. In an era of mass surveillance, digital platforms, and expansive data collection, the right to privacy has gained renewed importance not only as a fundamental right recognized under international law but also as a constitutional guarantee entrenched within the Nigerian legal system. Section 37 of the 1999 Constitution (as amended), which forms the bedrock for the protection of personal liberty, dignity, and autonomy provides that:
“The privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications is hereby guaranteed and protected.”
At the international level, instruments such as Article 17 of the International Covenant on Civil and Political Rights (ICCPR) and Article 9 of the African Charter on Human and Peoples’ Rights affirm privacy as a core human right, shielding individuals from arbitrary interference by state or non-state actors. In today’s digital age, where personal data is constantly collected, stored, and processed by governments, corporations, individuals and online platforms, the protection of privacy has become even more critical. It is no longer limited to safeguarding private correspondence or physical spaces but extends to digital communications, online identities, and data-driven transactions. This evolution underscores the need for robust legal and regulatory frameworks in Nigeria to ensure that constitutional guarantees of privacy remain effective in the face of modern technological realities.
Although the Constitution was enacted long before the advent of social media, digital surveillance, and data-driven economies, Nigerian courts and regulators have progressively interpreted its provisions to extend the right to privacy into the digital sphere, encompassing online communications, digital privacy, and data protection.
The constitutional guarantee of privacy cannot be divorced from cybersecurity and data protection laws as the Nigeria Data Protection Act, 2023 (NDPA) gives practical effect to section 37 by imposing obligations on data controllers and processors to safeguard personal data. The Cybercrime (Prohibition, Prevention etc) (Amendment) Act, 2024 also criminalizes unauthorized access to computer systems and unlawful interception of communications, reinforcing constitutional privacy rights in cyberspace.
- Freedom of Information Act, 2011 (FOIA)
The Freedom of Information Act, 2011 (FOIA) was enacted to promote transparency and accountability in governance by granting the public greater access to records and information held by government agencies. Its primary objective is to ensure that citizens can obtain information necessary for holding public institutions accountable.
However, the FOIA expressly provides exceptions in order to balance the right of access to information with the protection of individual privacy. In particular, Section 14 restricts government agencies from disclosing personal records and information relating to an individual’s private life, except where:
- the individual concerned has given prior consent; or
- the information is already lawfully available in the public domain.
This safeguard reflects the Act’s recognition that while public access to information is vital in a democratic society, such access must not encroach upon personal privacy rights protected under the Constitution and other data protection laws.
- Nigeria Data Protection Act 2023
This Act is a landmark statute that consolidates Nigeria’s commitment to protecting digital rights, strengthening cybersecurity, and building trust in the digital economy. The Act establishes the Nigeria Data Protection Commission (NPDC), defines data subject rights, introduces a clear enforcement framework, and provides the legal certainty and institutional authority needed to address data protection challenges in the 21st century. It outlines stringent obligations for data controllers and processors in case of breach to ensure transparency and mitigate harm. It also provides that data controllers must notify the Nigeria Data Protection Commission (NDPC) of any breach that is likely to compromise the rights and freedoms of an individual within 72 hours of becoming aware of it.[7] Furthermore, where a personal data breach is likely to result in a high risk to the rights and freedoms of a data subject, the data controller is required to communicate the personal data breach to the data subjects immediately. The communication should include the measures the data subject could take to mitigate the possible adverse effects of the data breach. Where direct communication to the data subject would involve disproportionate effort or expense, or is not feasible, the data controller may make public communication using one or more widely used media sources such that the data subject is likely to be informed.[8]
- Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act, 2024
This Act establishes an effective and unified legal, regulatory, and institutional framework for the prohibition, prevention, detection, prosecution, and punishment of cybercrimes in Nigeria. It is specifically designed to safeguard critical national information infrastructure, enhance cybersecurity, and ensure the protection of computer systems, networks, electronic communications, data, and computer programs. In addition, the Act seeks to uphold intellectual property rights and preserve the privacy rights of individuals in the digital space.
This Act criminalizes various forms of cybercrime including unauthorized access to computer systems, data interference, and cyber terrorism. It provides the foundation for prosecuting criminal aspects of data breaches.
- The Nigerian Communications Act
The Act established the Nigerian Communications Commission (NCC) as the primary regulatory authority for the telecommunications sector in Nigeria. The Commission is mandated to create an enabling environment for competition among industry operators while ensuring the delivery of qualitative and efficient telecommunications services across the country.
In furtherance of its statutory mandate, the NCC issued guidelines regulating the operations of Internet Service Providers (ISPs) and other internet protocol-based telecommunications services. These Guidelines impose an obligation on ISPs to inform users of any statements on cybercrime prevention or acceptable internet use published by the Commission or other relevant authorities. Importantly, the Guidelines stipulate that failure to comply with such acceptable use requirements may attract criminal liability, including prosecution under applicable laws.
- Central Bank of Nigeria’s Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Banks 2024.
The Framework establishes the minimum cybersecurity requirements for supervised financial institutions (SFIs), including commercial, merchant, and non-interest banks, as well as payment service banks. Its overall objective is to strengthen resilience in Nigeria’s financial sector by ensuring robust governance, risk management, and compliance mechanisms.This framework adopts a risk-based approach, compelling banks and financial service providers to proactively assess, manage, and mitigate cybersecurity risks in line with global best practices. Rather than prescribing a one-size-fits-all standard, it requires institutions to implement cybersecurity measures that are commensurate with the nature, scale, and complexity of their operations. This approach enhances flexibility while ensuring accountability in the protection of critical financial data and infrastructure.
The 2024 Framework is a significant step forward in aligning Nigeria’s financial sector with international cybersecurity benchmarks such as the NIST Cybersecurity Framework and ISO/IEC 27001 standards. By embedding accountability, continuous risk assessment, and proactive governance, the CBN seeks to fortify public confidence in digital banking and payment systems while reducing systemic risks posed by cybercrime.
International Influence of the General Data Protection Regulation (GDPR) on Nigerian Data Protection Framework
The European Union’s GDPR has significantly influenced the development of data protection regulation in Nigeria. It is considered the gold standard for privacy regulation, setting obligations for data controllers and processors and establishing strong enforcement mechanisms. One of the most significant areas of GDPR influence is cross-border data transfer which establishes strict conditions for transferring personal data outside the European Union. Similarly, the NDPA restrict data transfers outside Nigeria unless the destination country ensures an adequate level of protection, or subject to standard contractual clauses.[9] This ensures that Nigerian companies seeking to engage in international trade remain compliant with global standards. This extraterritorial application has encouraged Nigeria to align its domestic framework to international best practices. Additionally, the GDPR emphasizes the accountability principle, requiring organizations not only to comply with data protection rules but also to demonstrate compliance through policies, audits, and governance structures. This Act reflects a deeper alignment with GDPR standards, particularly in enforcement powers, penalties, and accountability measures.
Despite the GDPR’s influence on Nigeria’s data protection regime, the country continues to grapple with significant implementation challenges. There remains limited awareness among organizations and individuals about the scope of their obligations and rights under the law. Many entities either do not fully understand the requirements of the NDPA or lack the technical and organizational capacity to comply effectively. The Nigeria Data Protection Commission (NDPC) also struggles with enforcement capacity, limiting effective oversight. In addition, conflicts between data protection rules and sector-specific regulations create uncertainty for compliance. These challenges underscore the reality that legal reforms alone are insufficient; robust institutional support, harmonization of regulatory frameworks, and sustained public education are necessary to ensure effective data protection in Nigeria.
Liabilities for Data Breaches in Nigeria
- Criminal Liability
This Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act, 2024 criminalizes unlawful access to computer systems, identity theft, data interference, and related offenses. A data breach resulting from hacking, insider abuse, or system compromise may attract criminal prosecution, with penalties ranging from fines of up to 7million to imprisonment of up to 7years.[10] Organizations may also face liability and sanctions if found negligent in securing their systems against such intrusions. - Civil Liability
Organizations may face lawsuits from affected individuals for negligence, breach of fiduciary duty, or breach of contractual obligations, particularly where data subjects can prove that inadequate safeguards or reckless handling of their personal data led to unauthorized access, identity theft, or financial harm.[11] - Reputational and Commercial Liability
Beyond legal penalties, data breaches undermine consumer trust and investor confidence, potentially resulting in reputational damage, loss of customers, and reduced competitiveness. For regulated industries such as banking and telecommunications, breaches may also lead to stricter regulatory scrutiny or suspension of licenses.
- Regulatory Liability
(a) The NDPA imposes stringent compliance requirements on data controllers and processors, including breach notification obligations, technical and organizational safeguards, and data subject rights. Failure to comply attracts significant penalties. Major data controllers or processors that are found to have breached the provision of the Act may be subject to payment of a fine up to 2% of annual gross revenue or ₦10 million whichever is greater of its annual gross revenue. Other controllers/processors in breach maybe subject to fines up to 2% of annual revenue or ₦2 million.[12]
(b) Central Bank of Nigeria’s Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Banks 2024 mandates deposit money banks and payment service banks to maintain robust cybersecurity governance and reporting mechanisms. Failure to comply could result in regulatory sanctions, suspension of operations, or financial penalties.
Conclusion
Data breaches are not merely technological challenges but legal risks with far-reaching consequences. Beyond financial losses, they implicate constitutional rights, statutory obligations, and potential criminal liabilities. Nigeria has made significant progress with the enactment of the Nigeria Data Protection Act (NDPA) 2023, building on the foundation of the Nigeria Data Protection Regulation and aligning with international best practices. However, the increasing prevalence of cyberattacks underscores the urgent need for stronger enforcement, enhanced corporate accountability, and greater public awareness. For organizations, compliance should not be perceived as a regulatory burden but as a critical component of risk management and sound corporate governance. Likewise, individuals must recognize that asserting their rights under the NDPA is essential in ensuring transparency and accountability. As digital transformation accelerates, the capacity of Nigeria’s legal system and institutions to respond effectively to data breaches will determine the balance between innovation, security, and the protection of fundamental rights.
[1]A. Adepetun, Beware, Cyber-attacks, Threat on the Prowl, The Guardian, https://guardian.ng/technology/beware-cyber-attacks-threats-on-the-prowl/ Accessed August 18, 2025
[2]Data Breach: Definition, Explanation and Use cases, The Vation Ventures Glossary https://www.vationventures.com/glossary/data-breach-cybersecurity-explained Accessed August 18, 2025.
[3] Section 65
[4] O. Babalola, (2021) Privacy and Data protection Law in Nigeria, Ci plus limited.
[5] Ibid
[6] Ibid
[7] Section 40(2) Nigeria Data Protection Act, 2023
[8] Section 40(3) Nigeria Data Protection Act, 2023
[9] Section 41 Nigeria Data Protection Act, 2023
[10]Section 6 Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act, 2024
[11]Incorporated Trustees of Digital Rights Lawyers Initiative &Ors v. NIMC (2021)
[12] Section 48, Nigeria Data Protection Act, 2023