Governing The Digital Economy: Nigeria's Emerging Regulatory Framework

From national legislations to sector regulations, Nigeria is building a layered approach to internet governance. Nigeria's technology regulation has, over the past few years, undergone a quiet but consequential transformation.

What was once a patchwork of telecommunications rules and fragmented agency guidelines has matured into a multi-layered,multi-agency framework.

At the centre of this evolving framework are some key legislative and regulatory instruments, which collectively shape how digital activities, online platforms, personal data, cybersecurity, and emerging technologies are governed in Nigeria:

• The Cybercrimes Act
• the NCC Internet Code of Practice 2026,
• the National AI Strategy 2025,
• the Nigeria Data Protection Act 2023, and
• the NITDA Code of Practice for Internet
• the NCC Guidelines for the Provision of Internet Services
• the NCC Consumer Code of Practice Regulations

The Cybercrimes Act

The Cybercrimes Act 2015 (as amended in 2024), is Nigeria's principal statute for regulating conduct on the internet. The Act regulates how individuals, businesses, internet service providers, financial institutions, and government agencies use and secure cyberspace. The Act imposes cybersecurity obligations and protects digital infrastructure. As such, it serves as the foundation of Nigeria's cyber governance framework and remains one of the country's most consequential digital regulatory instruments.

The Act expressly states that its objectives are to provide a unified legal and regulatory framework for the prevention, detection, prosecution, and punishment of cybercrimes, protect critical national information infrastructure, and promote cybersecurity as well as the protection of computer systems, electronic communications, data, computer programs, intellectual property, and privacy rights.

One of the most important internet-regulation provisions is found in Part II of the Act. The law empowers the President, acting on the recommendation of the National Security Adviser, to designate certain computer systems, networks, programs, and data as Critical National Information Infrastructure (CNII) where their disruption could seriously affect national security, economic security, public health, or public safety. Once designated, the government may prescribe rules concerning protection and preservation of the infrastructure, access to and control of data, storage and archiving requirements, as well as disaster recovery and breach-response measures.

Section 6 of the Act criminalizes unauthorized access to computer systems and networks. A person who intentionally accesses a computer or network without authorization and obtains data important to national security commits an offence. The Act also criminalizes trafficking in passwords or access credentials intended to facilitate unauthorized access. These provisions regulate internet activity by establishing legal boundaries for accessing digital systems and by protecting both public and private networks from intrusion.

The Act also prohibits unlawful interception of electronic communications, including emails, electronic transfers, and other forms of digital communication as contained in Section 9. It also criminalizes interference with computer systems, network operations, and electronic messaging systems. This provision protects the confidentiality and integrity of internet communications and makes unauthorized monitoring or interference with online communications unlawful.

One major feature of the Act is its treatment of cyberterrorism. The Act criminalizes the use of computer systems or networks to threaten national security, public safety, critical infrastructure, or essential services. The penalty is life imprisonment as provided in Section 18 of the Act.

Organizations and service providers are saddled with the responsibility to assist law-enforcement investigations and preserve certain electronic records where legally required. The Act also establishes mechanisms for reporting cyber threats and facilitating cooperation between public authorities and private entities in responding to cybersecurity incidents. For internet service providers and technology companies, these obligations mean that compliance extends beyond ordinary business operations to include cybersecurity preparedness and cooperation with lawful investigations.

One of the most debated provisions of the Act is the offence of cyberstalking. Section 24 regulates the use of computer systems and online platforms to transmit communications intended to threaten, harass, intimidate, or cause substantial harm. This provision has frequently been invoked in cases involving online publications, social media activity, and digital communications. Critics have argued that the provision can affect freedom of expression if broadly interpreted, while supporters maintain that it is necessary to address online harassment and abuse. The Cybercrimes Act plays a direct role in regulating conduct on social media and other online platforms in Nigeria.

From an internet-governance perspective, the Cybercrimes Act regulates the internet in Nigeria by protecting critical digital infrastructure, criminalizing hacking and unauthorized access and regulating harmful online conduct.

The NCC Internet Code of Practice 2026

The Code’s Scope and Regulatory Reach

The Internet Code of Practice issued in February 2026 applies to Internet Access Service Providers licensed by the NCC and to online digital communication platforms operating in Nigeria. It integrates in a single document, rules on data privacy, cybersecurity, content moderation, artificial intelligence, child protection, and network neutrality.

This Code is a regulation issued in line with the provisions of Section 70 of the Nigerian Communications Act 2003 (Act) that empowers the Nigerian Communications Commission to issue subsidiary legislations on all matters pertaining to the provisions of the Act and its effective implementation.

Subscriber Metadata and Regulatory Oversight

One of its most significant provisions concerns subscriber metadata. Under Chapter 3.5, Internet Access Service Providers (IASPs) are prohibited from allowing third parties or government agencies to harvest transactional data, which the Code defines broadly to include behavioural trends, internet usage patterns, and spending habits without prior written approval from the NCC. That approval is itself conditional, subject to an assessment of effects on national security, consumer welfare, and personal data. The effect is to insert the Commission as a gatekeeper between the networks that carry Nigerian internet traffic and the various actors who might wish to mine it.

Cybersecurity Reporting and Incident Response

The Code is equally demanding on cybersecurity. Chapter 3.4 requires operators to notify both affected customers and the NCC within 48 hours of detecting a data breach. If full details are not yet available, a preliminary notification must be issued immediately, with a comprehensive update following within 14 days. Cyberattack reporting timeline is even stricter as operators must alert the NCC within four hours of detection and provide updates every four hours thereafter, with a confirmation report due within 24 hours. These timelines signal that the Commission regards cybersecurity not as an operational matter left to individual businesses, but as a shared public concern requiring near-real-time regulatory visibility.

Artificial Intelligence in Network Operations

Section 5.4 of the Code takes the regulatory gaze further still, into the domain of artificial intelligence. Operators must inform the NCC before deploying AI or other emerging technologies in their operations, explain how those tools work and to what end, and notify any subscribers who may be affected. This is a mechanism for ensuring that the Commission is never caught unaware by technological change happening inside the networks it oversees.

Content Moderation and Child Protection

Content moderation occupies Chapter 6. All online and digital communications platforms must draft and submit community guidelines to the NCC within six months of the Code's release, covering harmful content, disinformation, fraud, and unlawful material. Unlawful content must generally be removed within 24 hours of a directive. The Code also strengthens child protection by requiring IASPs to provide easy-to-activate parental controls, multilingual safety guidance, and default opt-in settings for services where minors or vulnerable individuals might otherwise be enrolled without fully understanding what they are agreeing to.

Network Neutrality and Compliance Monitoring

Finally, on the question of network neutrality, the Code is clear. Lawful content must not be subject to discrimination or deliberate traffic degradation, and any traffic management practices must be disclosed to consumers. Operators must also notify the NCC and the public whenever a network outage affects ten percent of subscribers or lasts more than four hours. Compliance reporting is biannual, and the implementation timeline gives regulated entities 180 days from publication before full monitoring begins.

Taken together, these provisions reveal a regulatory framework that extends well beyond traditional telecommunications oversight. The Code positions the NCC not merely as a sector regulator, but as a central actor in the governance of Nigeria's digital ecosystem. Its emphasis on transparency, accountability, cybersecurity, consumer protection, and technological oversight reflects an increasingly proactive approach to digital regulation, one that seeks to anticipate emerging risks rather than respond to them after the fact.

The National AI Strategy 2025

A Policy Backbone for AI Governance

Nigeria's National AI Strategy, published in 2025, is the country's first serious attempt to articulate a coordinated national position on artificial intelligence. It is not a binding legal instrument as it carries no penalties and creates no directly enforceable rights, but its significance should not be underestimated. The National AI Strategy is the policy backbone on which future AI-specific legislation will be built.

Vision and National Objectives

The vision is to leverage ethical and inclusive innovation to drive sustainable development. This vision is driven by three primary goals, which are: economic growth, through AI-driven productivity gains across manufacturing, agriculture, and services; social development, through improved access to healthcare, education, and financial services; and technological leadership, through a research and development ecosystem ambitious enough to position Nigeria as a regional AI powerhouse. Together, these objectives reflect an ambition not merely to adopt AI technologies, but to participate meaningfully in their creation, deployment, and governance.

The Five Foundational Pillars

The NAIS is built on five foundational pillars. The first concerns physical infrastructure, affordable high-performance computing and clean, sustainable energy for data centres on the grounds that advanced AI is impossible without the hardware to run it. The second focuses on ecosystem development, including the AI Synergy Alliance for international partnerships. The third pillar involves the deployment of lighthouse projects in sectors like healthcare and agriculture, designed to demonstrate AI's practical value and build public trust. The fourth establishes an AI Ethics Expert Group, tasked with overseeing the development of transparent, fair, and accountable AI systems. Its guiding principles of fairness, accountability, transparency, and inclusivity function as soft-law governance mechanisms, shaping behaviour in the absence of detailed statutory requirements. The fifth pillar calls for the creation of a dedicated regulatory body to enforce ethical standards and manage the risks associated with AI deployment.

Alignment with Existing Law

The Strategy is careful to situate itself within Nigeria's existing legal landscape. It acknowledges the Nigeria Data Protection Act 2023 as the governing framework for AI training datasets, insisting that data be gathered with informed consent and in ways that respect human dignity. It also navigates the intellectual property complexities raised by generative AI under the Copyright Act 2022. This alignment matters because it signals that Nigerian AI governance is being conceived as an integrated whole, rather than as a new silo operating independently of established law.

An Enabling Approach to Regulation

Most importantly, the NAIS reflects a philosophy of enabling regulation. Rather than treating AI primarily as a source of risk to be contained, it treats it as a source of growth to be cultivated. Governance, in this framing, is not just about setting limits but about creating the conditions in which innovation can flourish responsibly. The Strategy therefore positions regulation not as an obstacle to technological progress, but as a mechanism for ensuring that such progress remains inclusive, ethical, and aligned with national development priorities.

The Nigeria Data Protection Act 2023

A Comprehensive Data Governance Regime

The Nigeria Data Protection Act 2023, passed after years of fragmented data governance under agency guidelines, establishes a comprehensive legal regime for personal data regulation. Its influence shapes how platforms collect data, how AI systems are trained, how cybersecurity breaches are reported, and how cross-border digital commerce must be structured.

Core Processing Principles and Lawful Bases

The Act is built on a set of core processing principles including fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and accountability. In practice, these principles translate into a requirement to embed privacy-by-design and privacy-by-default into the architecture of any system that handles personal data. Consent must be freely given, specific, informed, and unambiguous. Processing may also be justified on grounds of contractual necessity, legal obligation, vital interests, public interest, or legitimate interest, though that last basis is new under the NDPA and is subject to a proportionality test that ensures it cannot be used to override data subjects' rights without justification.

Data Subject Rights and Operational Compliance

The rights conferred on individuals are extensive and operationally demanding. The right to access, rectification, erasure, restriction, portability, and objection each require organisations to build responsive systems capable of handling requests within statutory timelines. For technology companies, compliance is not a matter of policy documents alone, it requires genuine engineering investment. This means technology companies are required to build technical systems, processes, and infrastructure like encryption of user data, secure authentication systems, access controls for staff, breach detection systems, data backup infrastructure, etc that actually give effect to all their existing policies.

DPCMIs and Heightened Compliance Duties

A notable structural innovation is the introduction of Data Controllers/Processors of Major Importance (DPCMIs). These are entities classified by the Nigeria Data Protection Commission as Ultra-High, Extra-High, or Ordinary-High depending on the volume and sensitivity of the data they handle and their significance to Nigeria's economy and security. DPCMIs must register with the NDPC and appoint a dedicated Data Protection Officer, placing them under a more intensive compliance regime than smaller organisations. Sensitive categories of data including genetic and biometric data, health information, racial and ethnic origin, religious beliefs, and sex life, attract stricter processing conditions and typically require explicit consent. Processing children's data requires the consent of a parent or guardian, and controllers must implement age verification mechanisms to ensure they can identify when they are dealing with a minor.

Cross-Border Data Transfers

The NDPA also introduces meaningful constraints on the international flow of personal data. Transfers outside Nigeria are restricted unless the recipient jurisdiction can demonstrate adequate data protection safeguards, or unless appropriate contractual or organisational measures are in place. This provision has particular significance for cloud computing and globally distributed technology companies, which must now build Nigeria-specific compliance mechanisms into their data architecture.

The NDPA’s Role in AI Governance

Although the Act does not address artificial intelligence explicitly, its reach into AI governance is substantial. Any AI system that relies on personal data must comply with the NDPA's requirements on lawful processing, transparency, and data subject rights. Automated decision-making must be explainable and fair, and individuals must have a meaningful avenue to challenge decisions that significantly affect them.

Institutional Enforcement and Future Challenges

The Nigeria Data Protection Commission, which the Act creates, has the authority to issue guidelines, conduct investigations, and impose administrative penalties. It has already begun to reshape corporate behaviour, particularly in fintech, telecommunications, and digital services. The challenges ahead include enforcement capacity, regulatory overlap with sector-specific agencies, and uneven compliance, but the institutional foundations are in place.

The NITDA Code of Practice for Internet Intermediaries

The NITDA Code of Practice for Interactive Computer Service Platforms and Internet Intermediaries came into force in September 2022, issued by the National Information Technology Development Agency. It was a deliberate step as it showcases the government's attempt to bring global digital platforms operating in Nigeria under a structured domestic governance regime. It has been contentious ever since, though its practical impact has proven more nuanced than its critics initially feared.

Scope, Large Platforms, and Key Obligations

The Code applies to a wide range of entities: social media operators, as well as websites, blogs, streaming services, and e-commerce platforms. Its central distinction is between general platforms and Large Service Platforms (those with over one million registered users in Nigeria) ¹ Under Part III of the Code, Large Service Platforms are required to incorporate locally, maintain a physical presence, and appoint a liaison officer for government communications. They must also provide algorithm transparency on demand, explaining why users receive particular advertisements or why certain content is trending. And they must ensure that automated content moderation tools are subject to human oversight, to protect privacy and freedom of expression.

Takedown Requests, Complaints, and Reporting

All platforms, regardless of size, must acknowledge and act on government takedown notices within 48 hours as provided under Part I of the Code which states the obligations of Interactive Computer Service Platforms/Internet Intermediaries. User-reported unlawful content must also be removed as soon as reasonably practicable. Platforms must maintain complaint resolution mechanisms, preserve removed content and records as required by law, and engage certified fact-checkers to identify and verify claims that may constitute disinformation. Periodic compliance reports to NITDA are also mandatory.

Free Expression, Privacy, and Rule-of-Law Concerns

The NITDA Code sits at the intersection of platform governance, data protection, and free expression and it is precisely that intersection that makes it so contested. The criticisms levelled at the Code are serious and deserve honest engagement. Allowing government agencies to order content removed without explicit judicial authorisation raises genuine rule-of-law concerns. The use of undefined terms like "morality," "public interest," and "public order" creates scope for subjective and potentially politically motivated interpretation. Data preservation requirements of keeping deleted content on file after a user has requested its removal sit in direct tension with the NDPA's right to erasure and with constitutional privacy protections. The 48-hour removal window has also been criticised by legal experts as insufficient for platforms to verify whether content is actually unlawful, creating pressure to remove speech first and ask questions later. Until clearer procedural safeguards are incorporated, tensions between regulatory objectives, constitutional freedoms, and data protection rights are likely to remain a defining feature of the Code's operation.

Historical Context and Structural Weaknesses

These are not merely theoretical objections. The Code emerged in the shadow of Nigeria's 2021 Twitter ban and earlier attempts to legislate social media, and its critics have consistently framed it as part of a broader effort to shrink online civic space. The absence of judicial oversight in the takedown process remains, arguably, its most significant structural weakness.

Compliance Trends and Practical Impact

By 2024, Google, TikTok, and LinkedIn had each demonstrated high levels of adherence, collectively deactivating over 28 million accounts and removing 58 million pieces of harmful content. X (formerly Twitter) has failed to meet most requirements, including local incorporation and compliance reporting. Meta has submitted reports but used non-standard templates, making their data difficult to assess. Foreign digital companies contributed more than ₦2.55 trillion in taxes in the first half of 2024 alone, a figure that suggests the Code's economic and governance effects are real, even if unevenly distributed.²

The NCC Guidelines for the Provision of Internet Services

The Nigerian Communications Commission (NCC) has developed the Guidelines for the Provision of Internet Services pursuant to Section 70(2) of the Nigerian Communications Act 2003, to establish standards for Internet Service Providers (ISPs) and protect consumers. This Guidelines regulate the activities of ISPs and establish minimum operational requirements for the provision of internet services.

One of the major objectives of the Guidelines is to promote transparency in the relationship between service providers and consumers. Under Part I of the Guidelines, ISPs are required to provide accurate information regarding bandwidth allocation, internet speeds, service limitations, and the nature of the services being offered. The Guidelines also require providers to notify customers of significant changes to services, upgrades, or discontinuation of service, thereby strengthening accountability within the industry.

Another important aspect of the Guidelines is the requirement for ISPs to maintain customer support and complaint-handling mechanisms. By requiring providers to establish customer care centres and respond to complaints, the NCC seeks to improve consumer confidence and ensure that users have effective channels for resolving disputes. The Guidelines further require ISPs to maintain subscriber records and comply with relevant regulatory directives.

The NCC Consumer Code of Practice Regulations

The NCC Consumer Code of Practice Regulations establishes the consumer protection rules that all telecommunications licensees, including Internet Service Providers (ISPs), must follow when providing internet services in Nigeria. The Code regulates the internet indirectly by governing how providers interact with users, handle data, disclose information, resolve complaints, and maintain service standards.

A central requirement of the Consumer Code in Part II, Section 6 is that consumers must be given sufficient information to make informed decisions about communication services. Service providers are required to disclose the nature of their services, applicable charges, contract terms, limitations of service, and procedures for complaints and dispute resolution. This affects internet regulation by preventing ISPs from misleading consumers about the quality or conditions of internet access. Under Section 24 of the Code, Internet Service Providers are required to state the internet connection speed made available to consumers.

Another significant provision concerns the protection of customer information. The Consumer Code requires service providers to safeguard consumer information and restrict unauthorized disclosure of customer data. Providers may collect and use consumer information only for legitimate business purposes and must take reasonable steps t985 protect such information from misuse.

Although the Consumer Code is primarily consumer-focused, it supports internet regulation through quality-of-service obligations. Providers must deliver services in accordance with the terms represented to consumers and are expected to maintain acceptable service standards. The Consumer Code also regulates how internet providers structure their contracts with users under Part IV of the Code. Contract terms must be fair, clear, and understandable. Billing information must be accurate and transparent, and consumers must be informed of applicable charges before entering into service agreements. These provisions help prevent unfair commercial practices in the internet sector.

The Code serves as one of the legal instruments through which the NCC governs the relationship between internet service providers and internet users in Nigeria, ensuring that access to the internet is delivered in a fair, transparent, secure, and consumer-oriented manner.

A framework in the making

What these six instruments share, beyond their shared subject matter, is a common aspiration: to govern Nigeria's digital economy with the seriousness it deserves. The Internet Code of Practice, the National AI Strategy, the Data Protection Act, and the NITDA Code each address a different layer of the digital environment, and each reflects its prescriptive rules, soft-law principles, and rights-based obligations. Their co-existence creates both strength and friction.

While the framework demonstrates increasing regulatory sophistication, significant challenges remain. Enforcement capacity remains uneven and the tension between openness and control (seeing the internet as a space for commerce and expression versus as a space that governments feel compelled to manage) has not been resolved. On the one hand, the government seeks to promote the internet as a platform for business, innovation, and public communication.On the otherhand, it has shown a willingness to impose restrictions in pursuit of national security, public order, and other policy objectives, as illustrated by i the 2021 ban on X (formerly Twitter). At the same time, regulatory enforcement is uneven because there are still some technical, institutional, and compliance challenges.

Clearly, Nigeria is constructing a digital governance architecture that is increasingly aligned with global regulatory trends, and increasingly capable of shaping the behaviour of the platforms, services, and systems on which millions of Nigerians depend every day. The framework remains a work in progress, but its direction of travel is clear: towards a more structured, comprehensive, and influential system of digital regulation.

Footnotes

^{1 National Information Technology Development Agency, Code of Practice for Interactive Computer Service Platforms/Internet Intermediaries (26 September 2022), Part III.}

^{2  National Information Technology Development Agency, Code of Practice for Interactive Computer Service Platforms/Internet Intermediaries (Abuja: NITDA, 2025), online: NITDA https://nitda.gov.ng/wp-content/uploads/2025/08/NITDA25-COP-FOR-ICSPII-V2.pdf}

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.