An Analytical Study of Criminal Corporate Liability for Cybercrime Under the Cybercrimes Act 2015 in Nigeria

Corporate criminal liability for cyber offences including data breaches, cybersecurity failures, and facilitation of online fraud is addressed in the Cybercrimes Prohibition and Prevention Act 2015, yet the adequacy of this framework and the judicial development of corporate liability doctrines for digital offences have not been analytically examined in recent scholarship. This study analytically examines the corporate criminal liability provisions of the Cybercrimes Act, their relationship with the corporate criminal liability doctrine under Nigerian criminal law, and the empirical record of corporate prosecutions under the Act from 2016 to 2023. A doctrinal analysis was combined with review of all available Cybercrimes Act prosecution records and judgments, supplemented by structured interviews with 15 cybercrime prosecutors, digital forensics experts, and corporate counsel in Lagos. Results indicate that corporate prosecutions under the Cybercrimes Act are extremely rare, with enforcement focused almost entirely on natural persons. The Act's corporate liability provisions under section 17 do not adequately address liability for systemic cybersecurity failures that cause customer harm. The relationship between the Cybercrimes Act and sector-specific CBN and NCC cybersecurity guidelines is legally unclear. The study fills a significant analytical gap in Nigerian cybercrime corporate liability scholarship and concludes that the Cybercrimes Act requires amendment to create specific corporate liability for negligent cybersecurity failures and recommends a mandatory cyber incident reporting regime for financial and telecommunications institutions.

Keywords: cybercrime, corporate criminal liability, Cybercrimes Act 2015, data breach, Nigeria