Data protection
The Nigeria Data Protection Act 2023 created the Nigeria Data Protection Commission, with registration for major data controllers.
Protection rests on the Nigeria Data Protection Act 2023, which put the earlier regulation on a statutory footing and created the Nigeria Data Protection Commission. Major data controllers must register with the Commission, and data subject rights follow the familiar access, correction and erasure pattern.
Key points
| Regulator | Nigeria Data Protection Commission |
|---|---|
| Data controllers of major importance | Must register with the Commission and file annual returns |
| Compensation | The Act allows the Commission to order redress to the individual |
| Lawful bases | Modelled on the European framework, including legitimate interest |
In practice
- Complain to the Commission online; the process is free.
- Consider a fundamental rights application in parallel, which can be faster.
Where to go
- Nigeria Data Protection Commission — complaints and guidance.
Worth knowing
The Commission can order a company to pay redress to the affected person, not merely a penalty to the state. Ask for that outcome explicitly.
The general article: Data protection · Compare with another country
Privacy
Section 37 of the Constitution guarantees the privacy of citizens, their homes, correspondence and communications. The Nigeria Data Protection Act 2023 replaced the earlier regulation and established the Nigeria Data Protection Commission, with registration duties for major data processors and enforcement powers including remedial orders and penalties.
Key points
| Constitution | Section 37: privacy of homes, correspondence, telephone and telegraphic communications |
|---|---|
| Statute | Nigeria Data Protection Act 2023 |
| Regulator | Nigeria Data Protection Commission |
| Registration | Data controllers of major importance must register |
| Individual rights | Access, rectification, erasure, objection, portability |
| Remedy | Complaint to the Commission, and fundamental rights enforcement in the High Court |
| Fundamental rights procedure | Privacy claims can be brought under the expedited rules |
| Damages | Courts have awarded substantial sums for unlawful disclosure by banks and employers |
| Digital lending | Contacting a borrower's phone contacts has been penalised by the Commission |
In practice
- Use the fundamental rights procedure: it is faster and cheaper than an ordinary suit.
Recent changes
The 2023 Act put data protection on a statutory footing for the first time and created a standalone commission with enforcement powers.
Where to go
- Nigeria Data Protection Commission.
- Fundamental Rights (Enforcement Procedure) application to a High Court.
- Legal Aid Council of Nigeria.
Worth knowing
The Fundamental Rights (Enforcement Procedure) Rules make a privacy claim against a bank, employer or public body relatively quick and cheap — it is often faster than the regulator. Digital lending apps that harass a borrower's contacts breach both privacy and data protection law. The Commission has acted on this repeatedly.
Image rights
The Cybercrimes (Prohibition, Prevention, etc.) Act 2015, amended in 2024, criminalises cyberstalking, which includes sending grossly offensive or indecent messages and material, and covers threats. The Violence Against Persons (Prohibition) Act addresses related conduct, and the Nigeria Data Protection Act 2023 applies to identifiable images.
Key points
| Statute | Cybercrimes Act 2015, amended in 2024 |
|---|---|
| Offences | Cyberstalking, transmission of indecent or menacing material, threats |
| VAPP Act | Covers harassment and related conduct in the states where it applies |
| Data protection | Nigeria Data Protection Act 2023 for identifiable images |
| Enforcement | Police cybercrime units and the National Cybercrime Centre |
| Civil remedy | Fundamental rights enforcement application for breach of privacy |
| National Cybercrime Centre | Coordinates reports involving online offences |
| Extortion | Frequently accompanies image abuse and is separately punishable |
In practice
- Report to both the police cybercrime unit and the Data Protection Commission.
Where to go
- Nigeria Police Force cybercrime units.
- National Human Rights Commission.
- Legal Aid Council of Nigeria.
Worth knowing
The cyberstalking provision has been criticised for its breadth and has been used against journalists; the 2024 amendment narrowed parts of it. Frame complaints around the specific harm suffered. Framing the complaint as a data protection breach as well as a criminal matter opens a second, faster route to removal.
The general article: Image rights · Compare with another country
Speech and online harassment
The Cybercrimes Act 2015, amended in 2024, covers cyberstalking and online harassment, and defamation exists both as a crime and as a civil claim.
The framework rests on the Cybercrimes Act 2015, amended in 2024, which covers cyberstalking and online harassment, alongside criminal and civil defamation. The amendment narrowed the much-criticised offence of transmitting false information, after sustained litigation and regional court rulings.
Key points
| Cyberstalking provision | Section 24 of the Cybercrimes Act, narrowed by the 2024 amendment |
|---|---|
| Civil defamation | Available, with substantial awards in some cases |
| Criminal defamation | Exists in the criminal and penal codes |
| ECOWAS Court | Has ruled against the use of these provisions to silence journalists |
In practice
- Frame a complaint around the specific harm suffered rather than general offence.
- Consider civil proceedings where reputation rather than safety is the issue.
Where to go
- Nigeria Police cybercrime units and the NPF complaint response unit.
- National Human Rights Commission.
- Media Rights Agenda and other free expression organisations.
Worth knowing
Regional courts have repeatedly found the cyberstalking provision incompatible with free expression. The 2024 amendment narrowed it in response.
The general article: Speech and online harassment · Compare with another country
Copyright
The Copyright Act 2022 repealed and replaced the 1988 Act. It extended the term for literary, musical and artistic works to the author's life plus seventy years, introduced statutory notice-and-takedown and blocking mechanisms, strengthened remedies against digital infringement, and clarified exceptions for education, libraries and people with disabilities.
Key points
| Statute | Copyright Act 2022, replacing the 1988 Act |
|---|---|
| Term | Life plus 70 years for literary, musical and artistic works |
| Takedown | Statutory notice-and-takedown procedure introduced |
| Blocking | The Commission can direct blocking of infringing online services |
| Commission | Nigerian Copyright Commission, with enforcement powers |
| Exceptions | Education, libraries, archives and accessible formats |
| Blocking orders | The Commission can direct online services to disable access |
| Notification | Voluntary registration through the Commission is used as evidence |
| Collective management | Approved societies for music and reprography |
In practice
- Use the statutory takedown procedure: it is faster than court proceedings.
Recent changes
The Copyright Act 2022 is the most significant overhaul of Nigerian copyright law in over thirty years.
Where to go
- Nigerian Copyright Commission.
- COSON and MCSN for music rights.
- Federal High Court for infringement.
Worth knowing
The 2022 Act applies to acts committed after it came into force; older disputes are still judged under the 1988 Act, including its shorter term. The 2022 Act applies only to acts after it came into force. Older disputes remain under the 1988 Act, including its shorter term.
The general article: Copyright · Compare with another country
Identity theft
The Cybercrimes Act punishes identity theft and impersonation, with BVN and NIN misuse the central practical risk.
Section 22 of the Cybercrimes Act 2015 criminalises identity theft and impersonation carried out electronically. In practice the exposure runs through the Bank Verification Number and the National Identification Number: both are widely requested and widely misused. The EFCC and the police special fraud unit handle serious cases.
Key points
| Statute | Cybercrimes Act 2015 section 22, as amended in 2024 |
|---|---|
| BVN | Central to banking identity; check linked accounts through your bank |
| NIN | National identity number, managed by NIMC |
| Enforcement | EFCC and the Police Special Fraud Unit |
| Data protection | Nigeria Data Protection Act 2023 for the underlying breach |
| Banking | CBN consumer protection department for unresolved bank disputes |
In practice
- Ask your bank to list every account linked to your BVN and to freeze those you do not recognise.
- Report to the police or the EFCC and obtain a reference.
- Escalate to the CBN consumer protection department if the bank does not resolve it.
- Never send a photograph of your NIN slip to anyone who contacts you first.
Where to go
- EFCC.
- Central Bank of Nigeria consumer protection department.
- Nigeria Data Protection Commission.
Worth knowing
The BVN links all your bank accounts. Asking the bank for the full list of linked accounts is the single most revealing check, and you are entitled to it.
The general article: Identity theft · Compare with another country
Online shopping
The 2018 federal Act gives a right to reject unsafe or defective goods, backed by a commission with real enforcement powers.
Protection comes from the Federal Competition and Consumer Protection Act 2018, which gives a right to reject unsafe or defective goods and created a commission with real enforcement powers. The Commission handles complaints against online platforms and has issued orders against major retailers.
Key points
| FCCPA 2018 | Created the Federal Competition and Consumer Protection Commission |
|---|---|
| Right of return | Goods may be returned within a reasonable time if defective or unsafe |
| Online sellers | Covered, including marketplaces operating in Nigeria |
| Complaint process | Free complaints to the Commission, which can order redress |
In practice
- File a complaint with the Commission: it is free and it can order refunds.
- Keep the transaction record and delivery evidence.
Where to go
- Federal Competition and Consumer Protection Commission.
- Central Bank consumer protection department for payment disputes.
- State consumer protection agencies.
Worth knowing
The 2018 Act gave the Commission power to order redress directly, which is faster than any court route. Complaints can be filed online.
The general article: Online shopping · Compare with another country
Romance scams
A financial crimes commission with reporting channels, and a police cybercrime centre.
The economic and financial crimes commission receives reports of fraud, including romance scams, and the police operate a national cybercrime centre. Banks must act on a fraud report to place a lien on a receiving account, which is the only realistic route to recovery and works only within a very short window.
Where to go
- Economic and financial crimes commission
- National police cybercrime centre
- Your bank, to request a lien on the receiving account
- Central bank consumer protection, for unresolved disputes
Sources
- Economic and Financial Crimes Commission — report fraud, including romance scams
The general article: Romance scams · Compare with another country
General sources
- Nigeria.gov.ng — official government portal