A CRITICAL ANALYSIS OF NIGERIA'S CROSS-BORDER E- COMMERCE, DATA PRIVACY AND CYBERSECURITY LAWS AGAINST COMPARATIVE BEST PRACTICE

Abstract

Nigeria’s digital economy has expanded faster than the statutory framework meant to govern it. Four bodies of law bear directly on cross-border digital trade: the Nigeria Data Protection Act 2023 (NDPA), regulating international personal-data transfers; the Cybercrimes (Prohibition, Prevention, etc.) Act 2015, as amended in 2024, addressing the security of computer systems and electronic transactions; the Electronic Transactions Act 2023 and Federal Competition and Consumer Protection Act 2018 (FCCPA), governing online contract formation and consumer protection; and the Central Bank of Nigeria’s payment-system regulation, governing the infrastructure over which most cross-border e-commerce clears. Each was drafted and is largely enforced without sustained reference to the others, and without a shared institutional mechanism for resolving overlaps. This article undertakes a gap analysis of that arrangement, tested against comparative practice in the European Union, South Africa, Kenya and Singapore, and grounded in Nigerian judicial authority, regulatory guidance and enforcement practice. It identifies five persistent shortfalls: unresolved ambiguity in the NDPA’s adequacy-determination mechanism; the absence of any Nigerian adequacy decision four years after the Act’s commencement; a widening implementation gap between Nigeria’s 2024 ratification of the AfCFTA Digital Trade Protocol and its domestic statutes; the lack of a cross-border consumer dispute-resolution channel; and a documented jurisdictional contest between Nigeria’s data, competition and payment regulators, leaving digital lending and payment platforms without settled regulatory ownership. These are not defects internal to any one statute but structural gaps between statutes and institutions, requiring a single legislative framework rather than further piecemeal amendment.

Nigeria’s digital economy has expanded faster than the statutory framework meant to govern it. Four bodies of law bear directly on cross-border digital trade: the Nigeria Data Protection Act 2023 (NDPA), regulating international personal-data transfers; the Cybercrimes (Prohibition, Prevention, etc.) Act 2015, as amended in 2024, addressing the security of computer systems and electronic transactions; the Electronic Transactions Act 2023 and Federal Competition and Consumer Protection Act 2018 (FCCPA), governing online contract formation and consumer protection; and the Central Bank of Nigeria’s payment-system regulation, governing the infrastructure over which most cross-border e-commerce clears. Each was drafted and is largely enforced without sustained reference to the others, and without a shared institutional mechanism for resolving overlaps. This article undertakes a gap analysis of that arrangement, tested against comparative practice in the European Union, South Africa, Kenya and Singapore, and grounded in Nigerian judicial authority, regulatory guidance and enforcement practice. It identifies five persistent shortfalls: unresolved ambiguity in the NDPA’s adequacy-determination mechanism; the absence of any Nigerian adequacy decision four years after the Act’s commencement; a widening implementation gap between Nigeria’s 2024 ratification of the AfCFTA Digital Trade Protocol and its domestic statutes; the lack of a cross-border consumer dispute-resolution channel; and a documented jurisdictional contest between Nigeria’s data, competition and payment regulators, leaving digital lending and payment platforms without settled regulatory ownership. These are not defects internal to any one statute but structural gaps between statutes and institutions, requiring a single legislative framework rather than further piecemeal amendment.