Emerging trends in cybersecurity law and data privacy, and their impact on individuals and organisations

The exponential increase in data creation and processing has resulted in significant challenges in relation to the protection of sensitive information from cyber threats and ensuring digital privacy.

The world as it is today could best be described as a digitally interconnected one. This is in light of the proliferation of digital services and methods, whereby concepts such as social media, e-commerce and cloud computing have taken sway.

This has in turn led to the creation and storage of vast amounts of personal data, which now give rise to cybersecurity and data privacy issues. Consequently, governments worldwide have been actively creating cybersecurity laws and data privacy regulations to address these challenges.

As a whole, the legal landscape of cybersecurity and data privacy is rapidly changing, with increased regulation, evolving standards and a growing emphasis on data protection. Organisations are now grappling with cybersecurity threats to their IT systems and critical business data, while also facing expanding consumer and legal demands to respect personal information privacy.

Global legal framework

On the global level, the General Data Protection Regulation (GDPR), implemented by the European Union in 2018, is one of the most comprehensive data protection laws and has set a precedent for other nations. The GDPR mandates strict data handling practices, requiring businesses to protect user data with robust security measures. Due largely to the GDPR, data privacy has emerged as a global priority, with countries enacting laws to safeguard personal information in an era where data breaches are alarmingly common.

The Nigerian legal framework

The primary legislation addressing cybersecurity in Nigeria is the Cybercrimes (Prohibition, Prevention, Etc.) Act, 2015. The Act criminalises various cyber offences, including identity theft, cyberstalking and cyberbullying, while also prescribing penalties for these offences.

Taking it a step further, the recently enacted Nigeria Data Protection Act (NDPA) 2023 is a key development in the country’s data protection framework. In Nigeria, data protection is founded on the constitutional right to privacy under Section 37 of the Constitution of the Federal Republic of Nigeria 1999 (as amended).

Core NDPA statutory principles

• Data minimisation: limiting personal data collection to what is strictly necessary.
• Lawful consent: ensuring consent is freely given, specific and informed.
• Right to be forgotten: enabling data subjects to request permanent erasure.
• Access and rectification: mandatory rights to review and correct personal records.
• Accountability and DPO appointments: institutional statutory oversight obligations.

Corporate and organisational vulnerabilities

• Complex cross-border regulatory compliance regimes.
• Data localisation versus international cloud transfer restrictions.
• Ransomware, malware and insider data breach vulnerabilities.
• Severe statutory fines and civil litigation liabilities.
• Irreparable damage to corporate reputation and brand equity.

Impact on individuals and organisations

These laws give individuals greater control over their personal data, including rights to access, correct and delete information. Organisations, on the other hand, must navigate increasingly complex compliance obligations while ensuring strong cybersecurity practices. Non-compliance can result in significant fines, legal exposure and reputational damage.

Reports indicate that over 81% of companies have exposed sensitive data due to inadequate oversight and weak governance frameworks.

Conclusion and future horizon

As technology continues to evolve, so will the legal framework governing cybersecurity and data privacy. Emerging technologies such as artificial intelligence, blockchain and the Internet of Things present new challenges and opportunities for data protection. For organisations, proactive compliance with cybersecurity and data privacy laws should be viewed not merely as a legal obligation, but as a strategic necessity.

This publication is for informational, educational and thought-leadership purposes only and does not constitute formal legal counsel. Please seek direct professional advice on your specific circumstances.