Data Protection and Service Provider’s Liability in Nigeria2 min read

Cybersecurity is a big issue to businesses, government, and individuals. Any service providers that receive, send, or store data electronically may be a target of cyberattacks or breach.

Under the Cybercrime Act, a service provider means any public or private entity that provides communication services to users by means of:

  • a computer system,
  • electronic-communication devices, and
  • mobile networks.

Service providers also include any other entity that processes or stores computer data on communication services’ or service users’ behalf.

Service Providers’ Duties under the Act

The Act requires a service provider to keep all traffic data and subscriber information for a 2-year period. The relevant communication-services regulator or any law-enforcement agency is empowered to request service providers to:

  • preserve, hold, or retain any traffic data, subscriber information, non-content information, and content data or
  • release any information the service provider has been required to keep.

Once a law-enforcement agency requests a service provider to release information to it, the service provider must comply.

But the Act restricts:

  • a service provider’s duty to retain, process, or retrieve information and
  • a law-enforcement agency’s powers to request information from service providers.

The use of stored or requested information must be for “legitimate purposes” only based on:

  • what is provided for under the Act;
  • any other legislation;
  • regulation; or
  • an order of a court of competent jurisdiction.

The Act also protects an individual’s privacy by requiring that:

  • there must be due regard to the individual’s right to privacy under the Nigerian Constitution and
  • appropriate measures must be taken to safeguard the confidentiality of the data being used for law-enforcement purposes.

Anybody who contravenes the provisions above will be guilty of an offence. If convicted, the sentence is a 3-year jail term or N7million fine or both.

This post was written by Senator Ihenyen. Senator is a lawyer  with Assizes Law firm and  an associate at The Write House- Legal Writing Consultants & Trainers.