Provides telecom services, in Nigeria

Access to Registered Information in the National Identity Database Regulations, 2017 (S.I. No. 16 of 2017) · Read the law's page

• Where you are a person other than a security, Government or licensed private agency, obtain an application made by or with the authority of the registered individual, or the individual's consent given by submitting the National Identification Number or biometrics, before you receive that individual's registered information, and do not seek fingerprint or other biometric information through such an application (regulation 4(1) and (2)).
• Where you are a private agency verifying or authenticating a registered individual's identity against the National Identity Database, hold the licence the Commission grants, obtain the registered individual's consent and pay the applicable fees (regulation 7(1) and (2)).
• Where you are a Government agency, make a prior written request to the Commission from an official not below the rank of a Permanent Secretary or Director-General, and comply with the procedures, processes and guidelines the Commission prescribes (regulation 6(2)).for a public body
• Use devices that conform to the specifications and standards in the Commission's guidelines when obtaining registered information (regulation 8(2)).
• Do not use or disclose registered information obtained by the grant of access without authority, and do not access data or information contained in the National Identity Database without authority (regulation 9(2)(d) and (h)).

Mandatory Use of the National Identification Number Regulations, 2017 (S.I. No. 15 of 2017) · Read the law's page

• Treat the National Identification Number as mandatory for each transaction regulation 1(1) lists beyond the Act's own list, among them operating a bank account, cashing in on financial instruments, the purchase and sale of foreign currency in banks and bureau de change, documentation for loans, the purchase of insurance policies, the acquisition, sale or transfer of shares, the purchase and registration of telephone SIM cards and other communication devices, tenancy agreements, and executing any contract or business agreement (regulation 1(1)).
• Where you are a government agency listed in the First Schedule that offers a service regulation 1(1) lists, require any person transacting with you to produce a National Identification Number, and verify and authenticate the person or number in the National Identity Database through real-time online verification from the NIMC Verification Service Platform, a Card Acceptance Device, a Card Reading Device, or a combination of them (regulation 1(2)).when it serves a public body
• Give the Commission evidence of compliance when it demands it (regulation 5(a)), and allow it to audit the state of affairs and operations of your transactions or services on written notice of not less than 24 hours (regulation 6(a)).

Internet Code of Practice 2026, data breach notification (s. 3.4) · Read the law's page

• This binds an Internet Access Service Provider, meaning any entity licensed by the Nigerian Communications Commission that is engaged in the provision of an Internet Access Service in Nigeria (reached by declaring that you provide telecom services).
• Notify each affected customer of any breach relating to the customer's information within 48 hours of becoming aware of the breach, by email and text message or by another effective means the Commission approves.
• Where full details of a breach are not yet available, give affected customers a preliminary notification within the same 48 hours and a comprehensive update within 14 days after, or within a longer period the Commission approves.
• Notify the Commission in writing of any breach no later than 48 hours after you reasonably determine that a breach has occurred.

National Identity Management Commission (Establishment) Act, 2026 (Act No. 3 of 2026), ss. 24-27 · Read the law's page

• Do not access the data or information held in the National Identity Database for a registered person unless the registered person has given and not withdrawn consent to the disclosure, or the disclosure is necessary for compliance with a legal obligation you are subject to, for a task carried out in the public interest or in the exercise of official authority vested in you, for the prevention, detection, investigation, prosecution or punishment of an offence, or for the preparation or conduct of proceedings before a court (section 24(2)).
• Where you are provided with registered information in connection with a particular purpose, use it for that purpose only, unless the registered person consents to the other use, the other use is authorised or required by law, the other purpose is directly related to the purpose for which the information was collected, or the information is used in a form in which the registered person is not identified or for statistical or research purposes without being published in a form that can reasonably be expected to identify the person (section 24(6)).
• Where you use or disclose registered information, implement appropriate technical and organisational measures to ensure that the use or disclosure does not harm the rights and freedom of the relevant registered person (section 24(7)).
• State in each request for access to registered information the purpose for which it is required, the period of retention of the information, the recipient, and the security and confidential modalities for disposing of the information once it is no longer required (section 24(9)).
• Where you are an agent the Commission licenses to carry out authentication and verification on its behalf, store any registered information securely and perform only the services the Act and the Commission's directions provide for (section 25(1)).
• Where you facilitate, or provide the service for, a transaction listed in section 26(1), among them financial transactions, the opening of bank accounts, the purchase of insurance policies, registration for telecommunications services, consumer credit transactions and the payment of taxes, verify the identity of the parties involved in the transaction using the National Identity Number provided (section 26(4)).
• Do not, without lawful authorisation by the Commission, intentionally access or secure access to the National Identity Database, download, copy or extract data from it, reveal, share, use or display information contained within it, or use or tamper with its data to modify information relating to a registered person or to discover any information (section 27(1)).

Cybercrimes (Prohibition, Prevention, etc.) Act, 2015, section 21, Reporting of Cyber Threats, as amended by the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act, 2024 · Read the law's page

• This binds any person or institution, whether public or private, that operates a computer system or a network in Nigeria; there is no sector or size gate.
• Immediately inform the National Computer Emergency Response Team (CERT) Coordination Center, through your sectoral CERT or sectoral Security Operations Centre, of any attack, intrusion, or other disruption liable to hinder the functioning of another computer system or network.
• Report the incident to the National CERT within 72 hours of its detection. Failing to do so is itself an offence, punishable by denial of internet services and a mandatory fine of N2,000,000 payable into the National Cyber Security Fund.

Guidelines for Nigerian Content Development in Information and Communication Technology (ICT), as amended, August 2019, paragraph 4 of sections 11.1 and 12.1 · Read the law's page

• If you are a telecommunication company, host all subscriber and consumer data within the country, in line with existing legislation (section 11.1, paragraph 4).
• If you are a networking service company, host all subscriber and consumer data within the country (section 12.1, paragraph 4).

Cyber Resilience Framework for the Nigerian Communication Sector (CRF-NCS), Version 1.0, February 2026, ss. 3.4, 4.4 and 8.4 · Read the law's page

• This binds a communication service provider licensed under the Nigerian Communications Act, 2003, in each of the Framework's three tiers (reached by declaring that you provide telecom services).
• Develop a cybersecurity and cyber resilience framework or strategy that includes internal cybersecurity governance structures, a cybersecurity officer or focal point, regular risk assessments with compliance reports, and sharing of threat intelligence with NCC-CSIRT (section 3.4).
• Document and implement approved cybersecurity and cyber resilience policies and procedures, and establish a cyber risk management framework (section 4.4).
• Implement technical and organizational measures to safeguard data at rest, in transit and in use, such as encryption, data loss prevention and regular backups (section 4.4).
• Ensure that cybersecurity audits and vulnerability assessment and penetration testing detect vulnerabilities in the IT and OT environments of critical systems (section 4.4).
• Establish or contract a Cyber Security Operations Centre to monitor the network, endpoints, personnel, malicious code and third-party activities, and onboard to the NCC-CSIRT Vulnerability and Threat Exposure Management platform (section 4.4).
• Develop and implement a Cyber Crisis Management Plan, and conduct recovery drills at least annually (section 4.4).
• Submit cyber audit reports and compliance reports to NCC-CSIRT at least annually or as the Commission requires (section 8.4).

Cyber Resilience Framework for the Nigerian Communication Sector (CRF-NCS), Version 1.0, February 2026, ss. 4.4 and 7.2 and Annexure IV · Read the law's page

• This binds a communication service provider licensed under the Nigerian Communications Act, 2003, including a mobile network operator, internet service provider, mobile virtual network operator, infrastructure provider and data centre (reached by declaring that you provide telecom services).
• Report cybersecurity breaches and incidents to the Nigerian Communications Commission's Computer Security Incident Response Team, NCC-CSIRT, in line with the Framework (section 4.4).
• Make the first report within the 4 hour reporting timeline for detection, then confirm within 24 hours, with periodic 4-hour updates after the first detection (section 7.2 and Annexure IV).
• Classify each incident as critical, high, medium or low by the Framework's severity matrix, and report it by email, the NCC-CSIRT web portal, telephone or, where necessary, physical submission (section 7.2 and Annexure IV).
• Maintain a dedicated focal point for incident reporting, with clearly defined escalation and contact protocols (section 7.2).
• Submit a follow-up report within 7 days of the initial notification, with the post-incident analysis and lessons learned, the mitigation steps and updates on corrective actions, and the final assessment of impact and restoration status (Annexure IV).
• Where an incident escalates beyond its initial severity classification or poses broader systemic risks, update NCC-CSIRT immediately, using the fastest available communication channel (Annexure IV).