Stolen in Silence: The Legal Blind Spot Behind Nigeria's Cybersecurity Apathy 

Nigeria's cybersecurity and data protection framework has developed considerably in recent years, yet public engagement with digital privacy remains strikingly low. This paper argues that this apathy is not primarily a failure of public awareness, but a consequence of a legal architecture that was built to protect institutions, particularly financial and telecommunications bodies, before it was built to protect individuals. Examining the Cybercrimes (Prohibition, Prevention, etc.) Act 2015, its 2024 Amendment, and the Nigeria Data Protection Act 2023, the paper demonstrates that while individual data subject rights now exist on paper, the mechanisms for exercising them remain inaccessible, poorly publicised, and secondary to institutional and national security concerns. Drawing an analogy between physical and digital theft, the paper contends that Nigerian law has failed to give ordinary citizens a clear, socially recognised name for the harm caused by data theft and privacy violation, unlike the well-established legal and social vocabulary surrounding conventional robbery. This absence of naming, it is argued, shapes public consciousness: without a law that clearly identifies their experience as a violation with a remedy, victims of data theft come to regard it as misfortune rather than injustice, producing a self-reinforcing cycle of weak enforcement and low public pressure for reform. The paper concludes with targeted recommendations, including direct breach notification to affected individuals, simplified complaint mechanisms, and the extension of legal seriousness currently reserved for financial cybercrime to privacy and identity-based harm.