Cybercrimes (Prohibition, Prevention, Etc.) Act, 2015

The Cybercrimes (Prohibition, Prevention, Etc.) Act, 2015 is Nigeria's principal and comprehensive statute on cybercrime. Enacted on 15 May 2015, it provides a unified legal, regulatory and institutional framework for the prohibition, prevention, detection, prosecution and punishment of cybercrimes, and for the protection of critical national information infrastructure (CNII). It was significantly amended by the Cybercrimes (Prohibition, Prevention, Etc.) (Amendment) Act, 2024, signed into law on 28 February 2024, which revised twelve sections, notably narrowing the controversial cyberstalking offence and adjusting the cybersecurity levy. The Act creates a broad catalogue of offences. These include unauthorised access to computer systems (with enhanced penalties where the target is designated CNII), unlawful interception of data, data and system interference, misuse of devices, computer-related forgery and fraud, identity theft and impersonation, and a range of content offences including child pornography, cyberstalking, cyber-squatting, racist and xenophobic material, and the distribution of obscene material. It contains detailed electronic financial-fraud provisions targeting ATM, card and electronic payment fraud, manipulation of financial-institution systems, and phishing, reflecting the Act's strong fintech-fraud dimension. Identity-related and unauthorised-data-disclosure offences give it a data-protection overlap. On procedure and enforcement, the Act grants law enforcement powers of search and seizure of computers and digital evidence, interception of communications under judicial warrant, expedited preservation of computer data, and obligations on service providers to retain traffic data and subscriber information (generally for two years) and to cooperate with investigations. It provides for international cooperation and mutual legal assistance, extradition and cross-border data requests, broadly aligned with the Budapest Convention model. Institutionally, the Act designates the Office of the National Security Adviser (ONSA) as the coordinating body for cybersecurity and the implementation of the Act, establishes a Cybercrime Advisory Council drawn from numerous public and private bodies, and creates the National Cybersecurity Fund (financed by a levy on specified businesses, including financial institutions). Enforcement in practice is shared among the Nigeria Police Force, the EFCC and other agencies, with the Nigerian Computer Emergency Response Team (ngCERT) providing incident response. Section 24 (cyberstalking) has been heavily litigated and criticised on free-expression grounds, prompting its partial amendment in 2024.

1. 1Criminalises unauthorised access to a computer system, with enhanced penalties where the system is designated critical national information infrastructure (CNII).
2. 2Establishes offences of unlawful data interception, data and system interference, and misuse of devices.
3. 3Creates extensive electronic financial-fraud offences (card/ATM/payment fraud, manipulation of financial-institution systems, phishing) alongside identity theft and impersonation.
4. 4Contains content offences including child pornography, cyberstalking (s.24, amended in 2024), cyber-squatting and distribution of racist/xenophobic material.
5. 5Grants investigators search-and-seizure, interception under warrant, and expedited data-preservation powers, with service-provider data-retention duties (generally two years).
6. 6Provides for international cooperation, mutual legal assistance and extradition for cross-border cybercrime.
7. 7Designates the Office of the National Security Adviser as coordinating body, and establishes the Cybercrime Advisory Council and the levy-funded National Cybersecurity Fund.