Internet Code of Practice 2026, data breach notification

Section 3.4(a) of the Internet Code of Practice 2026 requires an Internet Access Service Provider to notify affected customers of any breach relating to the customer's information within 48 hours of becoming aware of the breach. Where full details are not immediately available, the provider issues a preliminary notification within the same 48 hours and a comprehensive update within 14 days after, or within a longer period the Commission approves.

The customer notification is made through email and text message, or by another effective means the Commission approves. Section 3.4(b) requires the provider to notify the Commission in writing of any breach no later than 48 hours after it reasonably determines that a breach has occurred. The Code defines a data breach as an incident in which sensitive or confidential data is viewed, stolen or used by an unauthorized party.

The Code applies to Internet Access Service Providers, which it defines as any entity licensed by the Nigerian Communications Commission that is engaged in the provision of an Internet Access Service. The Nigerian Communications Commission issued the Code as a Guidelines under section 70 of the Nigerian Communications Act 2003. The Commission published the Code as an amended edition of the Internet Code of Practice it first published in 2019. The Code's date line is February 13, 2026.

The Code states no commencement day of its own, and under section 2(2)(b) of the Interpretation Act an enactment with no provision on its commencement that is not contained in an Act of the National Assembly comes into force on the day it is made, so this row takes the Code's date line as its start. The Commission's Guidance Notes on the Code set a 90-day regulatory gestation period, running from the date of publication of the Code, before compliance monitoring and enforcement begin.