Data Breach in the Age of AI-Powered Attacks: A Nigerian Perspective

Under the Nigeria Data Protection Act 2023 (NDPA), a “personal data breach” is a breach of security leading to, or likely to lead to, the destruction, loss, alteration, unauthorised disclosure of, or access to, personal data that is transmitted, stored or otherwise processed (s. 65). The definition has not changed, but the ways breaches happen have. Artificial intelligence lowers the cost, skill and time needed to attack, and it creates new ways for data to leak from an organisation’s own systems. The legal duties under the NDPA, the Nigeria Data Protection Commission’s (NDPC) General Application and Implementation Directive 2025 (GAID) and the Cybercrimes Act stay the same, while the pace and sophistication of threats increase.

How AI Changes the Threat Landscape

More convincing social engineering. Generative tools produce fluent, personalised phishing in English, Pidgin, Yoruba, Hausa, Igbo and other languages, free of the spelling errors that once gave scams away. Voice cloning and deepfake video enable impersonation of executives, bank officials or colleagues. Fraudulent payment instructions, BVN/NIN-related requests and credential harvesting become far harder to spot. This is especially relevant in Nigeria’s fast-growing fintech, banking and telecoms sectors, where fraud already targets mobile and instant-payment channels.

Faster, cheaper reconnaissance and exploitation. Attackers can automate vulnerability scanning, analyse leaked datasets, test stolen credentials at scale and adapt malware to evade detection. Tasks that once required specialist teams are now within reach of less skilled actors.

Attacks on AI systems themselves. Organisations deploying AI face risks that traditional security programmes may overlook:

• Prompt injection, where malicious instructions hidden in content cause an AI assistant to disclose data or take unintended actions.
• Data poisoning, where corrupted training data alters a model’s behaviour.
• Model inversion and membership inference, where attackers extract or confirm personal data present in training sets.
• Over-permissioned AI agents that can read or send data across systems, widening the impact of any compromise.

Self-inflicted leakage. Employees pasting customer data, source code or contracts into unapproved AI tools (“shadow AI”) can cause an unauthorised disclosure without any hostile actor involved. Where personal data is involved, and particularly where it is sent to a foreign provider without a lawful basis or transfer safeguards, this can be both a reportable breach and a cross-border transfer violation.

The Legal Framework in Nigeria

Scope and regulator

The NDPA applies to processing of personal data of data subjects in Nigeria, and to controllers and processors established, or operating, in Nigeria. The NDPC is the regulator. The NDPA preserves earlier instruments, such as the NDPR 2019, only to the extent consistent with it, and the GAID 2025 now supplies the detailed compliance rules. These include the classification of “data controllers and processors of major importance” (DCPMIs), annual compliance audit filings, and breach-notification procedures.

Prevention: security and accountability (ss. 24 and 39)

Controllers and processors must implement appropriate technical and organisational measures to protect personal data. The NDPA requires regard to the amount and sensitivity of the data, the nature, degree and likelihood of harm, the extent of processing and the retention period. The standard is risk-based and moves with the threat environment. As AI-enabled attacks become commonplace, measures that were adequate a few years ago may no longer suffice. The security, accountability and data-minimisation principles (s. 24) also matter, because data you do not hold cannot be stolen. Where processing is likely to pose a high risk to data subjects, including deployment of AI systems that profile individuals or make automated decisions, a Data Protection Impact Assessment is required (s. 28). Organisations of major importance must also appoint a Data Protection Officer (s. 32).

Notification to the NDPC (s. 40)

Where a breach is likely to result in a risk to individuals’ rights and freedoms, the controller must notify the NDPC within 72 hours of becoming aware of it. The notification must describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. Under the GAID, notification is made through the NDPC’s prescribed channel. Where full information is not yet available, a prompt initial notification with later updates is the safer course. A processor must notify the controller without delay on becoming aware of a breach. Because the NDPA does not define “awareness” in detail, organisations should treat it as the point at which there is reasonable certainty that personal data has been compromised, and document how and when that conclusion was reached. EU (EDPB) guidance is persuasive at best, not binding.

Communication to data subjects (s. 40)

Where a breach is likely to result in a high risk to individuals’ rights and freedoms, the controller must notify affected individuals immediately, in plain and clear language, with advice on how to mitigate harm (for example, changing passwords, monitoring accounts, treating unexpected calls or messages with caution). The NDPC may also direct a controller to notify data subjects.

Documentation

Every breach should be recorded, with the facts, effects, decision on notification and remedial action, even where it is not reported. The NDPC can ask to see these records, and under the GAID they feed into compliance audit and audit-return obligations.

Other Nigerian laws that run in parallel

• Cybercrimes (Prohibition, Prevention, etc.) Act 2015 (as amended in 2024). Operators of computer systems and networks must report cyber threats and attacks to the national CERT (ngCERT) within 72 hours. Failure to report attracts a penalty. The Act also criminalises computer-related fraud, identity theft, unauthorised access and related conduct, which covers many AI-enabled attacks such as deepfake-assisted fraud and impersonation.
• Sectoral rules. Banks, payment service providers and other financial institutions are subject to the Central Bank of Nigeria’s cybersecurity framework and incident-reporting requirements, which impose much shorter reporting windows than 72 hours. Telecoms operators answer to the Nigerian Communications Commission, and capital-market operators and insurers have their own regulators’ requirements. Operators of designated critical national information infrastructure carry additional duties.
• Constitutional privacy. Section 37 of the 1999 Constitution protects privacy, and breach victims can rely on it alongside the NDPA.

Incident response plans should map every applicable clock and regulator, because one event can trigger several reporting duties simultaneously.

Penalties and liability

Under the NDPA, failure to comply can lead to enforcement orders and fines. For DCPMIs the maximum is the greater of ₦10,000,000 or 2% of annual gross revenue in the preceding financial year. For other controllers and processors it is the greater of ₦2,000,000 or 2% of that revenue. Data subjects may also seek compensation through the courts or complaints to the NDPC, and the NDPA creates criminal exposure in certain cases. Reputational harm and sectoral regulator sanctions often outweigh the fine itself.

Assessing Risk in an AI Context

Risk assessment determines whether and how you notify. Consider the type and volume of data (especially sensitive personal data, such as health, biometric, financial and children’s data), how easily individuals can be identified, the severity of consequences (fraud, identity theft, discrimination, physical harm), whether data was encrypted, and the vulnerability of those affected. Identifiers such as BVN, NIN, phone numbers and account details are particularly valuable for fraud. AI adds further factors: stolen data may be rapidly combined with other datasets or used to generate highly targeted scams and deepfakes, so the foreseeable downstream harm can be greater than the raw data suggests.

Practical Steps for Organisations

1. Update the threat model. Include AI-enabled phishing, deepfake fraud, SIM-swap and account-takeover scenarios, and attacks on your own AI deployments.
2. Strengthen authentication. Prefer phishing-resistant multi-factor methods and add out-of-band verification for payment or access requests, since voice and video are no longer proof of identity.
3. Govern AI use. Maintain an approved-tools list, a clear policy on what data may be entered into AI systems, vendor due diligence, and contracts that restrict training on your data. Check lawful basis and cross-border transfer requirements before personal data goes to offshore AI providers.
4. Conduct DPIAs. Assess AI systems that process personal data at scale or make or support decisions about individuals, and review them as the technology changes.
5. Limit privileges. Give AI agents and integrations least-privilege access and log their actions.
6. Minimise and protect data. Reduce retention, encrypt at rest and in transit, and pseudonymise where possible.
7. Invest in detection. Monitoring, anomaly detection and good logging shorten the time to awareness, which directly supports the 72-hour deadline.
8. Rehearse. Run incident exercises that include deepfake and AI-related scenarios, with legal, security, communications and the DPO involved, and pre-draft NDPC, ngCERT and sector-regulator notifications.
9. Manage processors. Require immediate breach notification and cooperation duties in contracts, and keep audit rights.
10. Meet filing duties. If you are a DCPMI, keep registration, DPO and annual compliance audit obligations up to date.

Conclusion

AI has not rewritten Nigerian data breach law, but it has raised the standard of care. Attackers move faster and sound more convincing, and organisations create new exposure through their own AI adoption. Nigeria still lacks a dedicated AI statute, so existing data protection, cybercrime, and sectoral rules apply to AI-related incidents. The NDPC and sector regulators will judge preparedness against what was reasonably foreseeable, and AI-enabled attacks now are. The organisations best placed to cope combine sound security, disciplined AI governance, rapid detection and a rehearsed response, and they document their decisions throughout.