On 1 October 2026, NITDA opened National Cybersecurity Awareness Month under the theme "Together for a Safer Cyberspace". The statement, signed by Corporate Communications director Hadiza Umar, warns of "AI-driven social engineering, deepfake impersonations, voice cloning, and fraudulent QR code attacks ("quishing")", and tells users to mind what they post publicly, because oversharing "can enable targeted social engineering attacks" (Techeconomy). It points to NITDA's "computer emergency response structure" for reporting incidents. That is sensible advice. The harder question is whether the rulebook behind it is as clear as the message.
The case for the awareness-first approach
The strongest case for NITDA's framing is practical. Voice cloning and QR-code fraud exploit people, not network configuration, and no platform rule stops a convincing phone call. The statement also tells users never to share OTPs, PINs or banking log-ins, to use multi-factor authentication and to patch promptly. Cheap, widely repeated hygiene advice is among the most proportionate tools a regulator has. It restricts no speech and burdens no start-up. We support it.
The weakness is what the statement leaves out. Per the Techeconomy report, it names no reporting channel, only a "structure". A user who receives a deepfaked voice note has nowhere specific to send it. Awareness campaigns work best when the reporting path is as concrete as the warning.
Two codes, one set of platforms
The regulatory background matters because platforms are where much of this fraud is distributed. Two instruments claim authority over them. NITDA's Code of Practice for Interactive Computer Service Platforms and Internet Intermediaries dates from 2022 (NITDA). The NCC's Internet Code of Practice followed in February 2026, after a public consultation on the draft (NCC consultation notice), with guidance notes published alongside it.
A July 2026 commentary by Gray & Silicon Legal Advisors describes the NCC code as applying to licensed internet access providers and to "online digital communication platforms operating in Nigeria" (Legal 500 / Mondaq). On that account, it requires operators to report cyberattacks to the NCC within four hours of detection and to notify customers and the NCC of a data breach within 48 hours. It also says unlawful content generally must be removed within 24 hours of a directive. The same commentary says the 2022 NITDA code requires platforms to act on government takedown notices within 48 hours and to file periodic compliance reports with NITDA. We could not read the PDFs of either instrument directly, so these figures rest on that summary. Other law-firm summaries of the 2022 code give different thresholds, which is itself a sign of how hard it is to know what applies.
The point is not that the regulators disagree on goals. Both want less harmful content and faster incident response. The point is that a platform serving Nigerian users could face two takedown clocks, two compliance reports and two regulators, each with a reasonable claim to jurisdiction.
The ministry's pause settles little
On 7 July 2026, Minister Bosun Tijani directed the NCC, NITDA and the data protection commission NDPC to "defer the implementation or enforcement of their regulations relating to internet platforms, online intermediaries or other cross-cutting digital economy matters, pending the conclusion of the Ministry's policy harmonisation exercise" (Nairametrics). It also said "the existing regulatory status quo shall be maintained" and created a Joint Technical Coordination Committee of the three agencies. The directive is "without prejudice to the statutory responsibilities of the respective institutions" (AllAfrica/Leadership).
There is a fair case that this was the right call. Stopping enforcement of overlapping rules is better than enforcing both, and consulting industry, civil society and academia through a joint committee is how harmonisation should work. But the reporting we reviewed identifies no deadline for the exercise and does not say which provisions fall inside the paused areas. Deferral applies only "to the extent that" provisions concern areas under harmonisation, and other provisions "remain fully operational". That leaves a platform guessing which obligations are live.
Why this matters for security itself
Uncertainty is not neutral for cybersecurity. Incident-reporting duties are the clearest example. A four-hour reporting window to one regulator, a separate reporting relationship with NITDA's emergency response structure, and a data-protection regime under the NDPC mean a breached firm must decide whom to tell first. Firms that spend that time on legal triage are slower to contain an attack. Smaller platforms, which cannot staff several compliance desks, bear the cost most.
A pro-innovation position does not mean no rules. It means one clear set of rules that a founder in Lagos can read in an afternoon. We would suggest the harmonised framework do four things:
- Name a single lead channel for incident reports, and let the other agencies receive copies from it.
- Set one takedown clock for unlawful content, tied to a court order or a specific statutory basis, so that speech is not removed on an agency's say-so alone.
- Publish a deadline for the Joint Technical Coordination Committee and say which provisions are paused.
- Fund the awareness work, with a published reporting address for deepfake and voice-clone fraud.
What to watch
NITDA's month-long campaign is a sound use of a regulator's voice. Its credibility will depend on what happens next: whether the committee reports, whether the NCC and NITDA codes are merged into one, and whether the final text protects lawful speech while giving platforms a workable compliance path. Users can be told to be vigilant, and platforms to be diligent, but both are easier to do when the rules are clear.