Nigeria's 48-Hour Data Breach Notification Requirement: Regulatory Implications And Comparative Analysis

Introduction

Across jurisdictions, regulators are increasingly moving beyond traditional data protection frameworks and adopting sector-specific cyber resilience requirements. As digital infrastructure becomes more critical to economic activity, supervisory authorities are demanding earlier visibility into cyber incidents and imposing stricter reporting obligations on entities operating within key sectors.

Nigeria has followed this trend. Through the Internet Code of Practice 2026 (the "Code"), the Nigerian Communications Commission ("NCC") introduced a range of obligations applicable to Internet Access Service Providers ("IASPs"), including a requirement to notify both the NCC and affected consumers within forty-eight (48) hours after determining that a breach involving consumer data has occurred.