Telecommunications operators in Nigeria occupy a unique position in the digital ecosystem — they collect and store vast amounts of subscriber data, call records, and internet traffic data that law enforcement agencies frequently seek in criminal investigations. The Cybercrimes (Prohibition, Prevention, etc.) Act 2015 imposes specific data retention obligations on telecom operators, balancing law enforcement needs against subscriber privacy rights.
Section 38 of the Cybercrimes Act 2015 requires all service providers — including telecommunications companies, internet service providers, and computer network operators — to retain traffic data and subscriber information for at least two years. Traffic data includes call data records (CDRs), SMS logs, internet connection logs, and related metadata.
Subscriber information includes names, addresses, and identification details of customers. This obligation applies regardless of whether the data is subject to any ongoing criminal investigation.
Step-by-Step Procedure to Resolve This Legal Matter:
- Preserve Contemporaneous Evidence: Collate physical receipts, verified bank timestamps, stamped letters, and electronic communication logs prior to formal intervention.
- Deliver Statutory Pre-Action Notice: Issue a formal written demand outlining the specific statutory breach and giving the opposing party statutory time to remedy the grievance.
- Engage Accredited Legal Counsel: Initiate judicial proceedings before the competent court of record or submit an official petition to the relevant regulatory commission.
When a law enforcement agency (LEA) such as the police, EFCC, DSS, or military intelligence requires access to retained data in connection with a criminal investigation, they must obtain the authorisation of the Attorney-General of the Federation under Section 38(2) of the Cybercrimes Act or comply with the lawful interception framework under the NCC (Lawful Interception of Communications) Regulations 2019. Telecom operators are required to cooperate with legally authorised data access requests and may not disclose the existence of the request to the subscriber without the LEA’s consent.
Key Evidential Considerations & Statutory Benchmarks:
- Documented statutory breach and verified timeline of events.
- Jurisdictional competence of the regulatory agency or superior court.
- Contemporaneous written correspondences, notices, and financial records.
- Quantifiable proof of pecuniary loss or civil rights violation.
“The rule of law ensures that statutory rights and duties cannot be compromised by informal arrangements or administrative fiat; every citizen has the constitutional right to due process.”
— Nigerian Legal Precedent & Constitutional Jurisprudence
The interaction between Section 38 of the Cybercrimes Act 2015 and the Nigeria Data Protection Act 2023 (NDPA 2023) creates a complex compliance environment for telecom operators. The NDPA 2023 requires a lawful basis for processing personal data, and the Cybercrimes Act provides a statutory obligation that constitutes a lawful basis under the NDPA 2023 for the mandated data retention.
However, operators must still implement appropriate security measures to protect the retained data and must not use it for any purpose other than law enforcement cooperation and legal compliance.
Telecom operators that fail to retain subscriber data in compliance with Section 38 of the Cybercrimes Act 2015, or that obstruct law enforcement access to retained data, commit an offence under the Act and are liable to substantial fines. Directors and officers of the telecom company who knowingly authorise or permit the non-compliance may also be personally liable.
The Nigerian Communications Commission (NCC) also has the power to sanction telecom operators that violate data retention obligations under the NCC Act and the relevant subscriber data regulations.
The two-year mandatory data retention period under the Cybercrimes Act 2015 has been criticized by privacy advocates as being excessively long and potentially violating subscribers’ constitutional rights to privacy under Section 37 of the 1999 Constitution. The NDPA 2023’s data minimization and storage limitation principles — which require that data be retained only as long as necessary for the purpose of processing — are in tension with the blanket two-year retention mandate.
For direct regulatory verification, official complaints, or accessing statutory registers without third-party fees, members of the public can consult the official portal of the Federal Road Safety Corps (FRSC) National Portal.
This regulatory tension has not yet been authoritatively resolved by Nigerian courts, and telecom operators must navigate both frameworks carefully until legislative or judicial clarification is forthcoming.
For deeper procedural insights and related Nigerian statutory principles, see our legal analyses below:
Ignorance of the law is no excuse.
This breakdown is spot on. Under the 1999 Constitution of the Federal Republic of Nigeria (as amended), the legal position on What Are the Data Retention Obligations of Telecom Operators Under the Cybercrimes Act 2015? is quite settled. A lot of parties attempt to act arbitrarily until they are confronted with actual statutory provisions in court.
Kudos to the LawTalks editorial team. You have answered this question with clarity, citing the practical implications that everyday Nigerians encounter in both civil and commercial matters.
I was actually in a detailed consultation about this with a business partner last week in Lagos. Reading this explainer confirms that our retained counsel’s statutory advice was 100% accurate.
What specific documentation or contemporaneous evidence is most critical for a claimant or petitioner to assemble before instituting an action regarding What Are the Data Retention Obligations of Telecom Operators Under the Cybercrimes Act 2015? in a Nigerian court?
Great question. From an appellate litigation standpoint, the primary document is the formal notice of claim or statutory pre-action notice where required by the enabling statute. Additionally, where electronic documents (emails, WhatsApp communications, or online payment slips) form part of your claim, ensure an affidavit of compliance under Section 84 of the Evidence Act 2011 is properly deposed to by the person managing the device. Having these documents verified and paginated before filing prevents interlocutory applications that stall proceedings.
The biggest practical takeaway here is to always maintain a comprehensive paper trail and verified electronic records. Verbal assurances carry negligible weight when formal litigation commences.
To add further context to this discussion, parties litigating What Are the Data Retention Obligations of Telecom Operators Under the Cybercrimes Act 2015? should note that Nigerian courts heavily scrutinize whether administrative dispute resolution mechanisms were exhausted before approaching the bench.
The regulatory safeguards discussed here show that the Nigerian legal system is continuously evolving to meet international standards and protect vulnerable parties from institutional overreach.
A senior colleague at our law chamber recently handled a contentious brief involving What Are the Data Retention Obligations of Telecom Operators Under the Cybercrimes Act 2015?. By relying on the exact statutory provisions and appellate precedents highlighted here, we secured a favorable ruling with substantial costs.
For legal practitioners and litigants, what is the required standard of proof when establishing bad faith or procedural impropriety regarding What Are the Data Retention Obligations of Telecom Operators Under the Cybercrimes Act 2015? under Nigerian rules of evidence?
An essential point for both litigants and practitioners. Nigerian courts distinguish between procedural irregularity that causes no miscarriage of justice and fundamental defects that strike at the root of jurisdiction. To succeed in establishing bad faith, the litigant must demonstrate not just an error of judgment by the authority, but an intentional breach of statutory duty or natural justice (audi alteram partem). Cogent affidavits and certified official records are indispensable in meeting this threshold.
This is easily one of the most thorough and practical treatises on What Are the Data Retention Obligations of Telecom Operators Under the Cybercrimes Act 2015? available online in Nigeria. A must-read for every citizen, corporate director, and legal researcher.