Nigeria

TerraLex Cross-Border Guide to Global Crisis Management Regulatory Guide

Welcome to the TerraLex global crisis management regulatory guide

When a crisis hits your organisation, you need to take action quickly. What practical steps can you and your team take to minimize the impact on your business? What are your reporting requirements in the relevant jurisdiction(s)? What legislation applies there?

Our guide provides you with the answers to these questions in relation to key jurisdictions and it supports your understanding of the relevant local legal framework. It also provides high level practical guidance for those crucial first 72 hours, together with contact details of the local TerraLex firm for when you need specialist advice.

A crisis, by its nature, is both serious and unexpected and your response and actions within the first 72 hours will most likely define its impact on your organisation.

It is therefore important to have in place robust procedures that, if followed, will help minimize the adverse consequences.

The crisis checklist below includes next steps which are common across all jurisdictions. Please refer to the chapter for the relevant jurisdiction for more detailed guidance on your obligations in that country.

How to Use: You can use the tools below to create bespoke reports for the jurisdiction(s) and topic(s) covered. Click into single jurisdiction for one location or use the compare tool to compare multiple jurisdictions. Select the jurisdictions and topics of interest to create your unique report. You also have the option to print or download using the ellipsis button in the top right corner.

Nigeria Global Crisis Management Regulatory Guide Guide

Firms:: Chief Rotimi Williams' Chambers
Authors:: Doris Ogah, Ngozi Giwa-Amu, Titofunmi Joseph Taoreed
Date posted:: 02/06/2023
Last update:: 18/07/2023

Data breach

On discovering a data breach, which regulators or other government agencies should be notified?

In Nigeria, the Nigeria Data Protection Bureau (NDPB) is the agency to notify for a data breach. The National Information Technology Development Agency (NITDA) is an agency created for the sole purpose of coordinating Information Technology practices and activities in Nigeria which then created the Nigeria Data Protection Regulation (NDPR) 2019 as a comprehensive regulation on data protection in Nigeria. The NDPB was then further created to implement the objectives of the NDPR 2019.

The Nigeria Data Protection Bureau is an office, set up for the purpose of protecting the rights of data subjects, the obligations of data controllers and data processors, and the transfer of data to a foreign territory. The Bureau, through its website allows individuals to directly notify them of a data breach. Data Controllers have a duty of self-reporting of data breaches to NDPB within 72 (seventy-two) hours of becoming aware of the breach. A Data Controller is also required to immediately notify the Data Subject of a Personal Data breach where the breach will likely result in high risks to the rights of the data subject. The Bureau also has the option to collaborate with other security agencies for data related crimes beyond its capacity.

What legislation, relating to both criminal offences and civil wrongs, covers such a breach?

The Nigeria Data Protection Regulation 2019 and, the Nigeria Data Protection Regulation and its Implementation Framework 2019 in collaboration with the Nigeria Data Protection Bureau 2022.

"Dawn" raids

What agencies have the power to conduct dawn raids on private sector companies? What legislation gives those agencies the power to undertake those inspections?

List: - Nigeria Police Act 2020

Federal Competition & Consumer Protection Commission Act 2018
Customs & Excise Management Act 2004
Economic and Financial Crimes Commission (Establishment) Act 2004
National Securities Agencies Act 2004
National Drug Law Enforcement Agency Act 2004
Trafficking in Persons (Prohibition) Law Enforcement and Administration Act of 2003
Immigration Act 2015

On what bases, including privilege and/or confidentiality, may organisations refuse to permit the seizure of documents?

Organizations may refuse to permit the seizure of documents marked privileged and/or confidential on the following grounds: - the consent of the client has not been sought and received, in the absence of a court order.

Whistleblowing

What are the circumstances under which an employee is entitled to protection when reporting an alleged wrongdoing?

In the absence of specific legislation, the court will protect an employee for an alleged wrongdoing either proved or unproved, such employee will be protected from unfavorable treatment and dismissal. If the claim for wrongdoing is dismissed, such company may claim damages against the employee. This applies to both civil and criminal acts.

What legislative protection does that employee enjoy?

Employees enjoy protection under the Whistleblowing Policy 2016. - This policy is domicile with the Federal Ministry of Finance.

An employee is protected from unfair treatment and dismissal.
Where the whistleblowing was based on genuine reason, an employee may bring an action in court for protection and/or restitution.
In relation to financial mismanagement, the whistleblower will be entitled to 2.5% - 5% of the recovered funds.

Anti-bribery and corruption

What are the main anti-corruption laws and regulations in your jurisdiction?

List: - Constitution of the Federal Republic of Nigeria 1999 (As Amended)

Nigerian Police Act 2020 - Established the Special Fraud Unit (SFU) responsible for the detection, prevention, and investigation of fraud.
Independent Corrupt Practices and Other Related Offences Commission (ICPC) Act 2000 - The Act tackles corruption, investigates and prosecutes corrupt practices carried out by government officials, the general public and private individuals.
Economic and Financial Crimes Commission (EFCC) Act 2004 - The Act was established to tackle specific financial and economic crimes through prevention, investigation, and enforcement. Unlike the ICPC, EFCC is focused on dealing with financial and economic related bribery and corruption that affects the economy.

Does the legislation have extra-territorial effect?

The legislation does not have extra-territorial effect. There exists possible liaison between anti-corruption agencies, territories that have a bilateral relationship, and territories signed to extra-territorial treaties.

What are the main enforcement bodies?

List: - Nigerian Police Force/Special Fraud Unit

Independent Corrupt Practices and Other Related Offences Commission
Economic and Financial Crimes Commission

Internal investigations

Is there any duty to report the issue, for example to a regulator?

There is a duty to report the issue in the course of internal investigations to the applicable regulator including: - Corporate Affairs Commission

Nigerian Police Force (Special Fraud Unit)
Independent Corrupt Practices and Other Related Offences Commission
Economic and Financial Crimes Commission
National Drug Law Enforcement Agency
National Agency for Food and Drug Administration and Control
Federal Competition & Consumer Protection Commission
Nigerian Customs Service
Nigeria Immigration Service

What is the protection from disclosure for documents generated as part of the investigation (for example, privilege)?

Such documents deemed privileged, receive protection subject to the following exceptions: - By the consent of the client

By court order
An intention to commit or prevent a crime.

Is the advice given by an in-house lawyer in relation to the investigation privileged and/or confidential?

Generally, advice given by an in-house lawyer in relation to an investigation is confidential and privileged. This applies to both oral and written communication.

Disclaimer: This guide contains summaries of general principles of law. It is not a substitute for specific legal advice and should not be relied upon in relation to the application of the law or subject matter covered.