LEAKED DRAFT: Nigeria's New Cybersecurity Bill Proposes AI-Powered Surveillance & Mandatory Local Hosting for Critical Data

In the high-stakes arena of Africa's burgeoning digital economy, Nigeria stands at a pivotal crossroad. Whispers from Abuja's legislative corridors, now crystalizing into potent public discourse, point to a leaked draft of a comprehensive new cybersecurity framework, reportedly poised for approval by the end of March 2026. This ambitious legislative push, primarily articulated through the proposed National Digital Economy and E-Governance Bill and complemented by the earlier 'Digital Sovereignty, AI Governance, and Fair Compensation Bill', is set to fundamentally reshape Nigeria's digital landscape. At its core are two transformative, and potentially contentious, proposals: widespread AI-powered surveillance and mandatory local hosting for critical data.

The Unyielding Cyber Storm: A Pretext for Policy Shift

The urgency behind these legislative moves is undeniably rooted in Nigeria's escalating cybersecurity crisis. The nation has become a prime target for cyber malefactors, with statistics painting a stark picture of digital vulnerability. In the first half of 2025 alone, Kaspersky reported that its security tools blocked over 1.46 million online attack attempts on Nigerian users, with nearly one in five people (19.9%) targeted. The on-device threat landscape was even more severe, with 4.97 million incidents blocked and 28.6% of Nigerian users encountering malware via infected media.

The economic toll is staggering. According to the Minister of Justice and Attorney General of the Federation, Lateef Fagbemi (SAN), Nigerian businesses faced an average of 4,388 cyberattacks per week during Q1 2025, marking a 47 percent increase from previous figures. This surge has catapulted Nigeria to fifth globally in cybercrime prevalence, with an estimated annual economic loss of $500 million. By Q3 2025, data breaches affecting Nigerian entities had skyrocketed by an extraordinary 1,047 percent compared to the preceding quarter. The December 2025 Global Cyber Attack Statistics further underscored this fragility, revealing Nigeria was targeted with 4,622 cyber-attacks per week, making it one of Africa's most targeted nations.

AI-Powered Surveillance: The Panopticon's Digital Gaze

Against this backdrop, the proposed National Digital Economy and E-Governance Bill seeks to empower the National Information Technology Development Agency (NITDA) with formal authority over algorithms, data governance, and digital platforms. A key provision subjects AI systems deployed in critical sectors such as public administration, finance, automated decision-making, and, most notably, surveillance, to enhanced scrutiny, including mandatory annual audits. Developers will be mandated to obtain formal licenses or registrations before deploying AI systems, and regulators will wield the power to demand information, issue enforcement directives, and even block or restrict AI systems deemed unsafe or harmful.

"You cannot be ahead of innovation, but regulation is not just about giving commands. It's about influencing market, economic and societal behaviour so people can build AI for good."
— Kashifu Abdullahi, Director General, National Information Technology Development Agency (NITDA)

While NITDA's DG, Kashifu Abdullahi, emphasizes fostering innovation and ensuring AI is built for good, the implications for privacy and civil liberties are profound. The shift towards a structured, risk-based approach to AI regulation aims for ethical use, transparency, and accountability. However, the scope of 'surveillance' within this framework raises critical questions about state capabilities, data access, and the potential for misuse in a nation navigating complex socio-political dynamics.

Mandatory Local Hosting: Crafting a Digital Fortress

Complementing the AI surveillance provisions is an aggressive push towards data localization. The 'Digital Sovereignty, AI Governance, and Fair Compensation Bill', introduced in February 2025, explicitly targets the extraction and monetization of Nigerian data by foreign companies, proposing strict data localization requirements for national security data. It also includes a "local content" mandate, stipulating that at least 30% of AI research on Nigerian data must be conducted domestically.

This legislative intent is further reinforced by the Nigeria Data Protection Act (NDPA) 2023 and its General Application and Implementation Directive (GAID) 2025. These instruments have significantly tightened cross-border data transfer rules, moving away from a previous 'whitelist' system and imposing stringent conditions for data transfer outside Nigeria. Recent enforcement actions by the Nigeria Data Protection Commission (NDPC), including administrative fines against MultiChoice Nigeria and a significant remedial fee of USD 32.8 million against Meta in 2025 for unlawful cross-border data transfers, signal a clear and assertive regulatory posture.

"Ransomware continues to scale through industrialised operations, while unmanaged GenAI usage is creating widespread data exposure at enterprise level."
— Omer Dembinsky, Data Research Manager, Check Point Research

The rationale behind data localization is multifaceted: enhancing national security, ensuring local law enforcement access to critical data, and stimulating the growth of Nigeria's indigenous technology infrastructure and economy. However, this mandate presents substantial challenges for businesses, particularly tech startups and multinational corporations relying on global cloud infrastructure and cross-border data flows for their operations.

Implications and the Road Ahead

The cumulative effect of these proposed legislative changes will be far-reaching. For startups, while provisions for regulatory sandboxes aim to foster innovation under supervised conditions, the compliance burden, including mandatory annual impact assessments and licensing for high-risk AI systems, will be significant. The existing cybersecurity talent shortage, with 67% of global organizations, including those in Nigeria, operating below required headcount, is likely to be exacerbated by the increased demand for specialized compliance expertise.

Foreign companies operating in Nigeria, particularly those handling personal data of Nigerian residents, will face heightened scrutiny and the imperative to re-evaluate their data architecture and operational frameworks to align with local hosting mandates and stringent data transfer regulations. This could spur significant investment in local data centers, as evidenced by MTN Group's commitment of a $240 million data center in Nigeria.

"As the threat landscape evolves, Nigeria is no longer dealing with opportunistic cybercrime, but confronting organised, identity-driven campaigns that move with intent, patience, and precision."
— Gbolabo Awelewa, Chief Business Officer, esentry

Nigeria's legislative maneuvers, particularly the impending National Digital Economy and E-Governance Bill, represent a bold stride towards establishing comprehensive digital governance. The intent is clear: to fortify national cybersecurity, assert digital sovereignty, and foster a controlled environment for AI innovation. However, the success of these ambitious proposals will hinge on a delicate balance between robust enforcement, fostering innovation, and safeguarding the fundamental rights and freedoms of its citizens in the ever-evolving digital realm.

As the anticipated March 2026 approval deadline looms, the global tech ecosystem watches intently. Nigeria, often a bellwether for continental trends, is setting a precedent for AI and data governance in Africa, a move that will undoubtedly ignite further debate and adaptation across the continent's rapidly expanding digital frontiers.