Rule 11.1 of the Lawful Interception of Communications Regulations, 2019 prohibits licensees from providing any communications services that cannot be monitored and intercepted. Further, Rule 9.1 of the same regulations states that where communication intercepted is encrypted, the communications service provider is required by the regulator to provide the key, code or access to the encrypted communication.

Nigeria has no rules applicable to the protection of trade secrets.

It is reported that there is no obligation for passive infrastructure sharing in Nigeria to deliver telecom services to end users. However, it is practised in both the mobile and fixed sectors based on commercial agreements.

In December 2014, Nigeria's National Council on Privatisation (NCP) approved the sale of Nigerian Telecommunications (NITEL) and its mobile arm (M-Tel) to NATCOM Consortium. The government still owns 25% of the NITEL (the incumbent). The government announced it plans to return to the market to sell the remaining 25% to Nigerians through Initial Public Offering (IPO).

It is reported that Nigeria mandates functional and accounting separation for operators with significant market power (SMP) in the telecom market.

According to Art. 31 of the Nigerian Communications Act, no person is allowed to operate a communication system or facility nor provide communication service in Nigeria, unless authorised to do so. Internet Service Provision and Internet Exchange licences authorise the provision of data services. On the other hand, the provision of voice-over Internet Protocol (VoIP) does not require a license.
However, in order to operate in the Nigerian telecom market, promoters or investors have to register a company in Nigeria whose entity is separate and distinct from its parent company. The locally incorporated branch or subsidiary, in accordance with the provisions of Section 20 of the Nigerian Investment Promotion Commission Act, must apply to the Nigerian Investment Promotion Commission ("NIPC") for company registration and other necessary authorisations and licenses to allow foreign participation.

Nigeria has not appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

It is reported that the Nigerian Communications Commission (NCC), the executive authority for the supervision and administration of services in the telecommunications sector, is independent from the government in the decision-making process.

Sections 11.1 (4) and 12.1 (4) of the Guidelines for Nigerian Content Development in Information and Communications Technology (ICT) require telecommunication companies and network service companies to host all subscriber and consumer data within the country in line with existing legislation.

Section 13.2 of the Guidelines for Nigerian Content Development in Information and Communication Technology (ICT) requires Ministries, Departments, and Agencies (MDAs) to ensure that all sovereign data is hosted locally on servers within Nigeria. The MDAs should also promote as mandatory the presence of system logs and other computer data logging technologies to aid in the effective troubleshooting and forensic investigation of events in Government systems.
Section 9.0 of the Cloud Computing Policy further stipulates that sensitive governmental and citizen data must be retained within national borders, either through internal frameworks operated by public institutions or via domestically based cloud service providers. This requirement applies specifically to data generated or managed by public sector entities.

In 2013, the National Information Technology Development Agency (NITDA) promulgated guidelines on Nigerian content in the information and communications technology sector, with amendments introduced in 2019. These guidelines are applicable to both public sector entities and private enterprises. Section 13.1 (2) of the guidelines mandates that both foreign and domestic "data and information management firms" store all data related to Nigerian citizens within Nigeria.

Sections 2.4.4.8 and 3.4.3.6 of the "Guidelines on Operations of Electronic Payment Channels in Nigeria" stipulate that all domestic payment transactions must be routed through a local switch within Nigeria.

Sections 41.1 and 43.1 of the Data Protection Act (DPA) provide that a data controller is allowed to transfer personal data from Nigeria to another country as long as there is an adequate level of protection of personal data in such country or the data subject consented to the transfer after being informed of the risk and did not withdraw the consent, the transfer is necessary for the performance of a contract to which the data subject is a party, the transfer is for the data subject's benefit, necessary for a public interest, necessary for legal action, or protect the vital interest of the data subject or third party.
Prior to the DPA, the Nigerian Data Protection Regulation 2019 (NDPR) was the go-to regulation on data protection. Although enforceable, it remains a subsidiary legislation, and there was no specific commission to oversee data protection. According to Section 2.11 of the NDPR, personal data transfers are permitted on condition that the destination country offers an adequate level of data protection. Determining the level of data protection is a prerogative of the National Information Technology Development Agency (NITDA) based on the Honourable Attorney General of the Federation's (HAGF) consideration of the foreign country’s legal system, rule of law, respect for human rights and fundamental freedoms, as well as relevant general and sector-specific legislation in public security, defence, national security, and criminal law. The countries whose levels of personal data protection are considered adequate are provided in the whitelist in Annex C of the Implementation Framework of the Data Protection Regulation and include 42 countries in addition to the EU Member States and all African countries who are signatories to the Malabo Convention 2014.
Where a transfer to a jurisdiction outside the whitelist is being sought, the Data Controller shall ensure there is verifiable documentation to conduct the transfer under one or more of the exceptions stated in Art. 2.12 of the NDPR. These include the consent of the data subject and the necessity for the performance of the contract.

Nigeria has ratified the World Intellectual Property Organization (WIPO) Copyright Treaty.

Nigeria has not joined any free trade agreement committing to open transfers of cross-border data flows.