Runs an essential service, in Nigeria

Nigeria Data Protection Act, 2023, data breach notification (s. 40; GAID 2025, art. 33) · Read the law's page

• Notify the Commission of a personal data breach likely to result in a risk to individuals' rights and freedoms within 72 hours of becoming aware of it, describing the nature of the breach and, where feasible, the categories and approximate numbers of data subjects and records concerned.
• Notify affected data subjects immediately after becoming aware of a breach likely to result in a high risk to their rights and freedoms.
• Give the Commission and every other relevant authority immediate information about a breach, whatever time you otherwise have, where that may help contain an imminent breach on a national scale, where containment may be needed nationally, sectorally or individually, or where the breach may affect the general public.
• Put in the notification the circumstances of the loss or unauthorised access or disclosure, the date or time period it occurred over, the personal information involved, an assessment of the risk of harm, an estimate of the number of individuals at real risk of significant harm, the steps you took to reduce that harm and to notify individuals, and the name and contact details of someone who can answer for you.

Designation and Protection of Critical National Information Infrastructure Order, 2024, paras. 2 to 7 · Read the law's page

• Collaborate with the other members of the Trusted Information Sharing Network, which the Office of the National Security Adviser establishes and of which owners and operators of Critical National Information Infrastructure are members, and share information on threats and vulnerabilities (paragraph 4).
• Submit the designated infrastructure to the periodic audit and inspection that the Office of the National Security Adviser carries out to ensure compliance with the Cybercrimes (Prohibition, Prevention, etc.) Act, 2015 and with any guideline or rule made under the Order (paragraph 6).
• Applies to an owner or operator of a computer system, network or communication infrastructure acquired, installed, deployed and operated in a sector the Order lists in its Schedule (power and energy; water; information, communication, science and technology; banking, finance and insurance; health; public administration; education; defense and security; transport; food and agriculture; safety and emergency services; industrial and manufacturing; mines and steel), which paragraph 2(1) designates as Critical National Information Infrastructure (reached by declaring that you operate an essential service).

Cybercrimes (Prohibition, Prevention, etc.) Act, 2015, section 21, Reporting of Cyber Threats, as amended by the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act, 2024 · Read the law's page

• This binds any person or institution, whether public or private, that operates a computer system or a network in Nigeria; there is no sector or size gate.
• Immediately inform the National Computer Emergency Response Team (CERT) Coordination Center, through your sectoral CERT or sectoral Security Operations Centre, of any attack, intrusion, or other disruption liable to hinder the functioning of another computer system or network.
• Report the incident to the National CERT within 72 hours of its detection. Failing to do so is itself an offence, punishable by denial of internet services and a mandatory fine of N2,000,000 payable into the National Cyber Security Fund.