One Rulebook in Practice: A Layered Framework for Cybersecurity and Data Protection Compliance in Nigerian Organisations

Abstract

This preprint proposes a six-component conceptual framework to help Nigerian organisations, especially SMEs, manage overlapping cybersecurity and data protection obligations as one programme. Drawing on the Nigeria Data Protection Act 2023, the amended Cybercrimes Act, recent regulator enforcement activity and published research on compliance in developing economies, the framework covers an obligation register, control alignment to ISO/IEC 27001 and NIST CSF 2.0, accountability structure, evidence and assurance, capacity building, and scheduled review. The paper sets out four propositions for future empirical testing and discusses the framework's limitations. It is a conceptual work and has not yet been empirically validated.