The Cybercrimes (Prohibition, Prevention, etc.) Act 2015, as amended by the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act 2024, is Nigeria’s principal legislation dealing specifically with cybercrime and cybersecurity.

The Act creates offences relating to unauthorised access to computer systems, computer-related fraud and forgery, identity theft, cyberstalking, cybersquatting, payment-system fraud and other forms of unlawful conduct involving computer systems and networks.

It also establishes obligations for financial institutions and service providers and provides an investigative and institutional framework for combating cybercrime.

The 2024 Amendment made important changes to several provisions, including sections 22, 24, 27, 30, 37, 38, 41 and 44.

This article explains 20 important aspects of the Cybercrimes Act that lawyers, businesses, technology professionals and members of the public should understand.

1. The Cybercrimes Act is the principal cybercrime statute

The Cybercrimes Act establishes a statutory framework for the prohibition, prevention, detection, prosecution and punishment of cybercrimes in Nigeria.

It addresses both traditional computer offences and newer forms of cyber-enabled conduct.

The Act should, however, be read together with other applicable legislation, including the Evidence Act 2011, the Nigeria Data Protection Act 2023 and relevant financial-sector legislation.

2. Critical national information infrastructure receives special protection

Section 5 provides special protection for designated Critical National Information Infrastructure.

The President may designate certain computer systems, networks, programmes, data and traffic data as critical national information infrastructure.

Unauthorised interference with such infrastructure attracts severe criminal consequences.

This provision is particularly important to operators of infrastructure whose disruption could have significant consequences for national security, the economy or essential public services.

3. Unlawful access to computer systems is an offence

Section 6 criminalises unlawful access to a computer.

The provision is relevant to conduct commonly described as hacking, including accessing a computer system or data without lawful authority.

Employers should therefore distinguish between:

• technical ability to access a system;
• administrative access granted by an employer; and
• legal authority to access particular data.

An employee who has system credentials does not necessarily have unlimited authority to access every database or file belonging to an organisation.

4. Cybercafés and public internet facilities are subject to statutory requirements

The Act contains provisions dealing with cybercafés and similar internet-access facilities.

These provisions are intended, among other things, to facilitate identification and investigation where public internet facilities are used in connection with criminal activities.

Operators should therefore consider their record-keeping and compliance obligations under the Act.

5. Unauthorised interference with computer systems is prohibited

The Cybercrimes Act criminalises various forms of interference with computer systems and data.

Conduct involving the unauthorised modification, deletion, corruption or disruption of computer data may therefore attract criminal liability where the statutory requirements are satisfied.

This is particularly relevant to employees, contractors and system administrators with access to corporate systems.

6. Computer-related forgery is a cybercrime

The Act creates an offence relating to computer-related forgery.

The offence is relevant where computer data or information is manipulated or created in a manner intended to produce a fraudulent or deceptive representation.

Digital records should therefore be treated with the same seriousness as other documentary evidence when investigating fraud.

7. Computer-related fraud is specifically criminalised

The Act also criminalises computer-related fraud.

Cyber-enabled financial crime may simultaneously fall under other Nigerian criminal statutes, depending on the facts.

For counsel, the important issue is to identify:

1. the precise offence charged;
2. its statutory ingredients;
3. the conduct alleged;
4. the evidence relied upon; and
5. whether each ingredient has been established beyond the applicable standard of proof.

8. Identity theft and impersonation are offences

Section 22 deals with identity theft and impersonation.

The 2024 Amendment expanded the provision by extending the relevant reference beyond a financial institution to public or private organisations.

This means that the provision now has broader application where identity-related cybercrime is committed against or through such organisations.

Identity theft may involve the unlawful use of another person’s identity, credentials or identifying information for an unlawful purpose.

9. Child sexual abuse material and related online conduct are criminalised

The Act contains stringent provisions dealing with child pornography and related conduct.

The provisions address conduct including the production, distribution, transmission, procurement and possession of prohibited material through computer systems or networks.

The Act also addresses certain forms of online grooming and attempts to arrange unlawful meetings with children.

These offences attract serious criminal penalties.

10. Cyberstalking is addressed by section 24

Section 24 deals with cyberstalking.

The 2024 Amendment changed the wording of section 24(1). Among other changes, the amended provision recognises specified circumstances involving pornographic messages and certain messages known to be false where communicated for purposes including causing a breakdown of law and order or posing a threat to life.

The provision must be interpreted according to its precise statutory language and the facts of the particular case.

It should not simply be assumed that every offensive, critical or unpopular statement published online amounts to cyberstalking.

11. Online threats and harassment may have criminal consequences

The wider provisions of section 24 address specified forms of threatening and harassing electronic communications.

Depending on the circumstances, communications involving threats to life, kidnapping, extortion or other prohibited conduct may expose the sender to criminal liability.

This makes preservation of electronic communications particularly important in cybercrime investigations.

Relevant evidence may include:

• WhatsApp messages;
• emails;
• SMS;
• social-media posts;
• direct messages;
• call records; and
• other electronically stored information.

12. Cybersquatting is prohibited

Section 25 addresses cybersquatting.

The provision is relevant to the unauthorised use of names, business names, trademarks, domain names and other protected words or phrases in circumstances covered by the Act.

This can become relevant where a person deliberately registers or uses an internet domain name or online identity associated with another person or organisation.

A domain-name dispute may therefore involve both intellectual-property considerations and cybercrime law.

13. Attempting, aiding or abetting cybercrime can create liability

Section 27 deals with attempt, aiding, abetting, conspiracy, counselling and procuring in connection with offences under the Act.

The 2024 Amendment also broadened part of section 27 by replacing the previous reference to a financial institution with public or private organisation in the relevant subsection.

Consequently, criminal responsibility may extend beyond the person who directly executes a cybercrime.

14. ATM, POS and other payment-technology fraud is criminalised

Section 30 deals with offences involving ATM and point-of-sale technology.

The 2024 Amendment expanded the wording to include other payment technology means.

This is significant because financial technology has developed considerably since the enactment of the original 2015 legislation.

The provision can therefore apply to modern electronic payment technologies beyond traditional ATM and POS transactions.

15. Financial institutions have statutory obligations

Section 37 contains obligations relating to electronic financial transactions and customer identification.

The 2024 Amendment specifically introduced the National Identification Number issued by the National Identity Management Commission into the identification framework.

Financial institutions must therefore consider the Cybercrimes Act alongside applicable Central Bank of Nigeria requirements, anti-money-laundering legislation, banking regulations and data-protection requirements.

16. Unauthorised electronic debits are specifically addressed

Section 37 also contains provisions relevant to unauthorised electronic debits from customers’ accounts.

The provision is particularly important in disputes involving:

• unauthorised transfers;
• compromised bank accounts;
• fraudulent electronic instructions;
• electronic payment fraud; and
• disputed customer transactions.

However, the Cybercrimes Act should not be considered in isolation. Contractual banking terms, CBN regulations and other applicable legislation may also affect the dispute.

17. Service providers have data-retention and protection obligations

Section 38 imposes obligations concerning traffic data and subscriber information.

The 2024 Amendment replaced the previous wording concerning retention with a requirement that relevant traffic data and subscriber information be kept and protected in accordance with the Nigeria Data Protection Act.

This creates an important connection between cybercrime investigations and data-protection compliance.

Organisations handling subscriber information should therefore examine both statutes when developing data-retention policies.

18. The Office of the National Security Adviser has important cybersecurity functions

Section 41 sets out functions relating to the Office of the National Security Adviser.

The 2024 Amendment introduced provisions concerning sectoral Computer Emergency Response Teams (CERTs) and Security Operations Centres (SOCs).

The amendment also provides for integration and routing of internet and data traffic by relevant public and private organisations within the statutory cybersecurity framework.

This demonstrates that cybersecurity has become an issue of organisational governance and regulatory compliance, not merely information-technology management.

19. The National Cyber Security Fund and cybersecurity levy

Section 44 establishes the National Cyber Security Fund.

The 2024 Amendment provides for a 0.5% levy on the value of electronic transactions by businesses specified in the Second Schedule.

The amendment also introduced enforcement provisions for businesses that fail to remit the levy, including significant financial penalties and consequences relating to their operating licences.

Businesses within the statutory framework should therefore determine whether the levy applies to them and ensure compliance with applicable requirements.

20. Cybercrime investigations may involve warrants for electronic evidence

Section 45 provides an important investigative framework for cybercrime.

A law-enforcement officer may apply to a Judge in Chambers for a warrant for purposes connected with obtaining electronic evidence in a cybercrime investigation.

The statutory framework may permit authorised investigators to:

• enter and search premises;
• search persons or conveyances;
• seize relevant evidence;
• search computers and electronic devices;
• obtain computer data;
• deal with encrypted or coded information; and
• require production of relevant computer equipment.

These powers are significant and should be exercised within the statutory framework and consistently with applicable constitutional and procedural protections.

Cybercrime and Electronic Evidence

Cybercrime cases frequently depend on electronic evidence.

Relevant evidence may include:

• emails;
• WhatsApp messages;
• SMS;
• social-media communications;
• bank transaction records;
• server records;
• subscriber information;
• mobile-phone data;
• computer files;
• CCTV recordings; and
• forensic copies of electronic devices.

The admissibility and evidential value of such material must also be considered under the Evidence Act 2011, particularly its provisions on electronic evidence.

A cybercrime prosecution therefore involves two related questions:

First: has the prosecution established that the accused committed an offence under the Cybercrimes Act?

Second: is the evidence relied upon legally admissible and sufficient to prove the relevant ingredients of that offence?

Cybercrimes Act and the Nigeria Data Protection Act

The Cybercrimes Act and the Nigeria Data Protection Act 2023 can apply simultaneously.

The Cybercrimes Act focuses primarily on cybercrime prevention, investigation, prosecution and cybersecurity, while the Nigeria Data Protection Act establishes a framework for the lawful processing and protection of personal data.

The 2024 amendment to section 38 expressly links service-provider data retention and protection to the Nigeria Data Protection Act.

Businesses should therefore treat cybersecurity and data protection as related compliance obligations.

Practical Cybersecurity Compliance Checklist

Businesses should consider implementing:

1. Access controls — limit access to systems and data according to legitimate business requirements.
2. Authentication controls — protect sensitive accounts and systems with appropriate authentication.
3. Employee policies — regulate the use of company computers, devices, passwords and data.
4. Incident-response procedures — establish a clear process for responding to cyber incidents.
5. Data-protection controls — align personal-data processing with the Nigeria Data Protection Act.
6. Vendor controls — assess cybersecurity risks associated with third-party providers.
7. Payment controls — strengthen safeguards against electronic-payment fraud.
8. Evidence preservation — preserve relevant electronic evidence immediately after a suspected incident.
9. Reporting procedures — identify statutory and regulatory reporting obligations.
10. Legal review — obtain legal advice where a cyber incident may constitute an offence or create regulatory exposure.

Frequently Asked Questions

What law governs cybercrime in Nigeria?

The principal legislation is the Cybercrimes (Prohibition, Prevention, etc.) Act 2015, as amended by the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act 2024.

Is hacking a crime in Nigeria?

Yes. The Act criminalises unlawful access to computer systems and related forms of unauthorised interference.

Is cyberstalking a criminal offence?

Yes. Section 24 creates offences relating to specified electronic communications, and that provision was substantially amended in 2024.

Does the Cybercrimes Act apply to social media?

It can. Where conduct on social media satisfies the elements of an offence under the Act, the fact that the conduct occurred on a social-media platform does not prevent criminal liability.

However, not every offensive or controversial online statement is automatically a cybercrime.

Can law-enforcement officers search a computer during a cybercrime investigation?

The Act provides a statutory warrant procedure for obtaining electronic evidence, including searches involving computers and electronic devices.

Does the Act regulate banks?

Yes. Financial institutions have specific obligations concerning electronic financial transactions and customer identification.

Does the Act regulate internet and telecommunications service providers?

Yes. The Act contains provisions concerning traffic data and subscriber information and forms part of Nigeria’s broader cybersecurity framework.

Does the Cybercrimes Act apply together with the Nigeria Data Protection Act?

Yes. The two statutes can operate together, particularly where cybercrime investigations involve personal data, subscriber information or traffic data.

Conclusion

The Cybercrimes Act has developed into a broad legal framework covering much more than traditional internet fraud.

It addresses unlawful access, computer-related fraud and forgery, identity theft, cyberstalking, cybersquatting, payment technology fraud, electronic financial transactions, service-provider obligations, cybersecurity institutions, critical national information infrastructure and investigative powers.

The 2024 Amendment significantly changed important parts of the framework, including sections 22, 24, 27, 30, 37, 38, 41 and 44.

For lawyers, businesses and technology professionals, the correct approach is to read the Cybercrimes Act alongside other applicable legislation, particularly the Evidence Act, Nigeria Data Protection Act, financial-sector legislation and constitutional protections.

For detailed legal research, consult the relevant provisions of the Cybercrimes Act on Nigerian LawCompass and examine the applicable judicial authorities.

Legal Disclaimer: This article is provided strictly for information and educational purposes only. It is not intended to constitute, and should not be relied upon as, legal advice. The application of the law depends on the facts and circumstances of each case, the applicable legislation, regulations, constitutional provisions, contractual arrangements and judicial decisions. Professional legal advice should be obtained where a specific cybercrime, cybersecurity, investigation or compliance issue arises.