Nigeria

Africa AI Strategies Cannot Say No - AU Framework

African AI governance efforts (AU Continental AI Strategy, and national strategies in Ghana, Zimbabwe, Nigeria, Kenya, Rwanda) are framed around "development" but reproduce existing global governance paradigms without necessarily addressing African-specific needs.

Directive on deployment of cybersecurity self-assessment tool

On 30 March 2026, the Central Bank of Nigeria issued a directive announcing the deployment of a Cybersecurity Self-Assessment Tool (CSAT) for regulated financial institutions, including payment service providers. The measure requires institutions to complete and submit the CSAT through a dedicated portal, providing information on cybersecurity governance, risk management, third-party controls, incident response, and operational resilience, with supporting documentation based on data as of 31 ...

Nigeria - National Digital Economy and E-Governance Bill Signed into Law

Nigeria signed into law the National Digital Economy and E-Governance Bill in March 2026, establishing a risk-based AI regulatory regime with NITDA as the technical regulator. The framework introduces risk-based licensing requirements for high-risk AI systems, making Nigeria one of the first major African economies to mandate AI governance. A National AI Council is established, and providers of high-risk AI must register and comply with requirements.

Nigeria - National Artificial Intelligence Strategy (NAIS) Finalized

Nigeria finalized its National Artificial Intelligence Strategy and accompanying policy framework in late March 2026, with the government seeking legislative approval from the National Assembly. The strategy establishes comprehensive policy direction for AI development and governance in Nigeria, complementing the National Digital Economy and E-Governance Bill.

Endorsement of joint statement on AI generated imagery

On 3 March 2026, the Nigeria Data Protection Commission (NDPC) issued a statement on joining 60 other data protection authorities in endorsing the joint statement on Artificial Intelligence (AI)-generated imagery and the protection of privacy. The endorsement is part of a broader national framework for responsible artificial intelligence (AI), which includes the National AI Strategy and the NDPC General Application and Implementation Directive (GAID). The statement aims to address privacy con...

Advisory on android systems compromised by multiple malware

On 3 March 2026, Nigeria's Computer Emergency Response Team (ngCERT) issued a high-risk advisory warning that multiple Android malware families, including Triada, Hummer, Rootnik, Prizmes, Uupay, and Android Backdoor, are actively compromising devices through pre-installed firmware, repackaged applications, and third-party downloads. The malware exploits known vulnerabilities to gain root access, enabling data theft, financial fraud, botnet participation, and persistent backdoor control that ...

Guidance notes for implementation and enforcement of Internet Code of Practice 2026

On 13 February 2026, the Nigerian Communications Commission issued guidance notes on implementing and enforcing the Internet Code of Practice 2026 under the Nigerian Communications Act 2003. The note clarifies regulatory oversight and governance expectations for licensees and digital platforms. The note sets expectations on open internet standards, traffic blocking and prioritisation, cyber security supervision, enforcement over non-personal transactional data, collaboration with the Nigeria ...

Inquiry into innovation, inclusion and integrity in financial technology sector

On 2 February 2026, the Central Bank of Nigeria adopted a report on innovation, inclusion, and integrity in the financial technology sector, including ethical and transparent Artificial Intelligence (AI) practices. The report encourages firms to adopt ethical and transparent AI practices, particularly in credit and risk decision-making, and proposes a dedicated "Responsible AI in finance" workstream to bring together regulators, industry, academia, and international peers to develop governanc...

Nigeria - National Digital Economy and E-Governance Bill (NITDA)

Nigeria is on track to pass a comprehensive AI law by the end of March 2026 through the National Digital Economy and E-Governance Bill, giving NITDA authority over algorithms, data governance, and AI systems. The proposed legislation aims to establish Nigeria as a leading AI governance hub in Africa, covering high-risk AI systems in finance, public administration, surveillance, and automated decision-making.

United States-Nigeria Data Protection Privacy Project

On 15 January 2026, the Nigeria Data Protection Commission (NDPC) announced the data protection privacy project with the United States (US). The NDPC agreed with a United States delegation on an implementation roadmap for the project. The project concerns cross-border data governance and is relevant to digital service providers engaged in Nigeria–US data flows. The NDPC highlighted structured cooperation and alignment of regulatory approaches, building on the NDPC’s Strategic Roadmap and Acti...

Data Protection Commission's annual report on implementation of Data Protection Act and enforcement expansion

On 1 January 2026, the Nigeria Data Protection Commission (NDPC) adopted a report focusing on the implementation of the Nigeria Data Protection Act 2023, including strengthening enforcement mechanisms, expanding sector-wide compliance monitoring, and issuing the General Application and Implementation Directive (GAID) 2025. The Directive mandates semi-annual reporting and credential assessments for Data Protection Officers, strengthens lawful basis and consent requirements, imposes privacy not...

Cybersecurity regulation in Nigerian Communications (Enforcement Process, etc.) Regulations, 2025

On 31 October 2025, the Nigerian Communications Commission (NCC) closes the public consultation, open since 9 October 2025, on the Draft Nigerian Communications (Enforcement Process, etc.) Regulations, 2025. The draft mandates that all operators retain call data records securely and make them available to competent authorities for lawful investigation in accordance with the Cybercrime (Prohibition, Prevention, etc.) (Amendment) Act, 2024. It prohibits tampering, destruction or distortion of c...

Cybersecurity regulation in Guidelines for Insurtech Operations

On 30 August 2025, the National Insurance Commission’s Guidelines for Insurtech Operations, including cybersecurity regulation, enter into force. The guidelines introduce requirements for logical access controls, periodic penetration testing, dual verification for website updates, and secure transmission of client data within three days. They also require operators to maintain their digital systems, conduct annual independent technology audits, encrypt transmitted data, and implement business...

Nigerian Communications Commission review of Internet Code of Practice 2019

On 29 August 2025, the Nigerian Communications Commission (NCC) closes the public consultation on the review of the Internet Code of Practice 2019. The review sets out seven areas for reform. These include the governance of offensive and misleading content such as deep fakes, misinformation and incitement, with stronger safeguards for child online protection. They also cover governance principles for online platforms and parameters for international cooperation, as well as measures to ensure ...

Nigeria-Zambia Memorandum of Understanding on Cooperation in Data Protection

On 8 October 2025, representatives of the Nigeria Data Protection Commission (NDPC) met with the Office of the Data Protection Commissioner (ODPC) of Zambia in Lusaka on the sidelines of the Digital Government Africa (DGA) Summit 2025. Both authorities announced plans to sign a Memorandum of Understanding (MoU) on cooperation in data protection. The MoU will formalise collaboration between the NDPC and ODPC in areas including compliance, enforcement, policy development, and regulatory capacit...

Nigeria's associate membership to global cross-border privacy rules forum

On 4 August 2025, the Global Cross-Border Privacy Rules (CBPR) forum membership committee submitted a recommendation to the Global Forum Assembly (GFA) to admit Nigeria as an associate member. The committee evaluated Nigeria’s application under the Forum’s terms of Reference and determined that the criteria for Associate status were satisfied. Nigeria confirmed its support for the 2022 Global CBPR declaration and framework and indicated that Nigeria's Data Protection Act 2023 focuses on the p...

Whitepaper on the National Blockchain Policy

On 16 May 2025, the Federal Ministry of Communications, Innovation and Digital Economy published the Whitepaper on the National Blockchain Policy to provide a structured plan for the use of blockchain in Nigeria. The Whitepaper states that blockchain can support financial inclusion by reducing transaction costs, improve supply-chain transparency in agriculture, and allow secure digital identity. It expands on the National Blockchain Strategy. It explains the need for cooperation between gover...

Data localisation requirement in Nigerian Digital Sovereignty and Fair Data Compensation Bill, 2025 (SB. 722)

On 20 February 2025, the Nigerian Digital Sovereignty and Fair Data Compensation Bill, 2025 (SB. 722) was introduced in the Senate. The Bill would require that Nigerian user data be stored within the country’s borders rather than on foreign cloud servers. The Bill applies to foreign companies offering data services in Nigeria and sets conditions on how Nigerian user data is held to enhance national and data security.

Online Harms Protection Bill

On 12 December 2024, the National Information Technology Development Agency (NITDA) published a White Paper on the Framework for an Online Harms Protection Bill in Nigeria, developed in partnership with Advocacy for Policy and Innovation (API). The White Paper outlines a proposed regulatory framework aimed at addressing online harms such as cyberbullying, hate speech, misinformation, and child exploitation, while balancing the protection of digital rights and freedoms. It advocates for a co-r...

National Information Technology Development Agency analysis of compliance with laws and misinformation management by social media platforms

On 4 December 2024, the National Information Technology Development Agency (NITDA) released an analysis of compliance with laws and misinformation management by social media platforms. The Code of Practice for Interactive Computer Service Platforms and Internet Intermediaries requires platforms with over one million users to submit annual compliance reports in alignment with Part II, Section 10 of the Code. This regulation promotes transparency and adherence to regulatory standards, aiming to...

Nigeria Data Protection Act (Amendment) Bill (SB 650)

On 21 November 2024, Nigeria Data Protection Act (Amendment) Bill, 2024 (SB 650) was introduced to the Senate and passed its first reading. The Bill proposes changes to Sections 5 and 65 of the Data Protection Act 2023, requiring entities to maintain a fixed operational business location staffed to engage with regulators and fulfil legal obligations. Non-compliance for a continuous period of 30 days would result in a prohibition from operating within Nigeria. The amendment also introduces def...

Registration obligation for data controllers and processors of major importance in Nigeria Data Protection Act, 2023 (Act No. 37)

On 1 October 2024, the obligation for data controllers and processors of major importance to register with the Nigeria Data Protection Commission (NDPC) under the Data Protection Act entered into force. The Act required controllers and processors meeting the criteria established by the NDPC to register by 12 December 2023 and provide information on the risks, safeguards, and security measures adopted to protect the data stored. The NDPC issued a guidance outlining criteria and obligations. Th...

Nigeria Data Protection Commission guidance notice on registration of data controllers and data processors of major importance (NDPC/HQ/GN/VOL.02/24)

On 30 September 2024, the Nigeria Data Protection Commission Guidance Notice on Registration of Data Controllers and Data Processors of Major Importance NDPC/HQ/GN/VOL.02/24 (Pursuant to Sections 5d, 6(c), 44, 45, and 65 of the Nigeria Data Protection Act) entered into force. The implementation was postponed from 30 June 2024 to 30 September 2024. This notice mandates the registration of data controllers and processors that handle personal data of over 200 data subjects within six months or o...

NDPC investigation into Fidelity Bank for alleged data protection regulation breach

On 21 August 2024, the Nigerian Data Protection Commissioned (NDPC) issued a fine of NGN 555.8 million in its investigation into Fidelity Bank for breach of the Nigerian Data Protection Act. In particular, the NPDC found that Fidelity Bank processed personal data without data subject consent and used non-compliant third-party data processors.

Federal Competition and Consumer Protection Commission investigation into Meta Platforms and WhatsApp over alleged violations of antitrust laws, data protection regulations, and consumer protection acts

On 18 July 2024, the Federal Competition and Consumer Protection Commission (FCCPC) issued a final order to Meta Platforms, Inc. and WhatsApp LLC, following a 38-month joint investigation with the Nigeria Data Protection Commission (NDPC). The order mandates changes to Meta's data handling in Nigeria, including requirements to reinstate users' control over their data, update privacy policies to comply with Nigerian law, cease sharing WhatsApp user information with Facebook companies without e...

CBN Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Banks

On 1 July 2024, the "Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks (DMBs) and Payment Service Banks (PSBs)" was implemented. The framework was issued by the Central Bank of Nigeria (CBN) on 31 May 2024, requiring DMBs and PSBs to implement these measures by 1 July 2024. It sets out minimum cybersecurity requirements for financial institutions to strengthen their defences against cyber threats. It covers areas such as governance, risk identification, third-party ris...

Central Bank of Nigeria implementation guidance on collection and remittance of national cybersecurity levy (circular Ref: PSM/DIR/PUB/LAB/017/004)

On 1 July 2024, The Central Bank of Nigeria (CBN)'s circular Ref: PSM/DIR/PUB/LAB/017/004 regarding the implementation guidance on the collection and remittance of the national cybersecurity levy has been fully implemented. The deadline for all other financial institutions to complete system reconfigurations had arrived. Banks and mobile money operators had until 2 June 2024, while all other financial institutions had until 30 June 2024 to ensure compliance. This levy, set at 0.5%, applies t...

Designation and Protection of Critical National Information Infrastructure Order, 2024

On 25 June 2024, the Designation and Protection of Critical National Information Infrastructure Order 2024 was published in the official gazette and subsequently implemented, establishing cybersecurity measures across 13 economic sectors. The Order designates specific computer systems, networks and communication infrastructure as Critical National Information Infrastructure (CNII), placing them under enhanced protection and oversight by the Office of the National Security Adviser (ONSA). The ...

Promoting local content obligation in Digital Marketing Regulation Bill 2024 (HB 1435)

On 22 May 2024, the Digital Marketing Regulation Bill, 2024 (HB. 1435) was introduced in the House of Representatives. The Bill would require designated gatekeepers to promote local content by allocating platform space to content creators established in Nigeria.

Central Bank of Nigeria circular on withdrawing guidance on collection and remittance of the national cybersecurity levy

On 17 May 2024, the Central Bank of Nigeria (CBN) adopted circular Ref: PSM/DIR/PUB/LAB/017/005, withdrawing the previous circular Ref: PSM/DIR/PUB/LAB/017/004 on the National Cybersecurity Levy. The withdrawn circular required financial institutions to start deductions by 19 May 2024 and complete system reconfigurations within four to eight weeks, with a 0.5% levy on electronic transactions funding the National Cybersecurity Fund (NCF).

Consumer protection requirements in National Digital Economy and E-Governance Bill, 2024

On 4 July 2024, National Digital Economy and E-Governance Bill, 2024 (SB 498) passed its first reading. The Bill requires service providers or vendors to provide clear and accessible information, including their name, address, email, and telephone number. Consumers are granted the right to cancel contracts before processing. It mandates compliance with data protection standards for personal information collected during transactions and requires the disclosure of detailed terms, conditions, an...

Service provider regulation in National Digital Economy and E-Governance Bill, 2024

On 4 July 2024, National Digital Economy and E-Governance Bill, 2024 (SB 498) passed its first reading. The Bill requires service providers to meet specified standards for interoperability, scalability, and the use of approved government ICT resources in public procurement processes. It also includes provisions for the adoption of sandboxes to test emerging technologies.

Cybersecurity regulation in Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act 2024

On 28 February 2024, the President signed the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Bill 2024 into law. The amendments to the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act No. 17, 2015, clarify the criteria for cybercrimes and reduce the reporting timeframe for cybersecurity incidents to 72 hours, mandating reporting through sectoral Computer Emergency Response Teams (CERTs) or Security Operation Centres (SOCs). The scope of the Act is expanded to include all p...

National Ai Strategy 01082024 Copy

Data Protection Commission Code of Conduct for Data Protection Compliance Organisations

On 15 December 2023, the Nigerian Data Protection Commission (NDPC) adopted the “Code of Conduct for Data Protection Compliance Organizations (DPCOs) 2023”. The Code aims to regulate competent firms licensed as Data Compliance Organisations (DPCs) in accordance with the Nigeria Data Protection Act 2023. The Code sets out objectives such as promoting professionalism, ensuring uniformity in compliance processes, and ensuring trust in Nigeria's digital data governance processes. The Code also ou...

National Artificial Intelligence and Robotic Sciences (Establishment) Bill (HB 601)

On 12 October 2023, the National Artificial Intelligence and Robotic Sciences (Establishment) Bill (HB 601) was introduced to the House of Representatives. The Bill would establish a regulatory framework for the development and deployment of artificial intelligence and robotics, set standards for ethical AI use, and promote research and innovation in the sector.

Personal data protection regulation in Nigeria Data Protection Act, 2023 (Act No. 37)

On 12 June 2023, the Data Protection Act, 2023 (Act No. 37), which outlines data protection regulations, entered into force. The Act outlines data subjects' rights, including the rights to access, correction, deletion, objection, withdraw consent, data portability, and not to be subject to a decision based solely on automated processing of personal data. Furthermore, the Act outlines obligations for data controllers, such as processing personal data in a fair, lawful and transparent manner, c...

Data protection authority governance in Nigeria Data Protection Act, 2023 (Act No. 37)

On 12 June 2023, the Data Protection Act, 2023 (Act No. 37) entered into force. The Act establishes the Nigeria Data Protection Commission, which has the power to enforce the Act's obligations. The Act also lays out procedures for investigations and applicable penalties in the case of violations.

Cybersecurity regulation in Nigeria Data Protection Act, 2023 (Act No. 37)

On 12 June 2023, the Data Protection Act, 2023 (Act No. 37), which outlines cybersecurity obligations, entered into force. The Act requires data controllers and processors to implement cybersecurity measures proportionate to the amount and type of personal data being processed and the manner of processing. The Act requires data controllers and processors to notify the Nigeria Data Protection Commission and affected data subjects of relevant breaches.