Introduction
Artificial intelligence, cloud computing, cybersecurity and digital sovereignty have fundamentally changed the way governments think about data. Around the world, policymakers are increasingly asking where data should be stored, who should have access to it and under what circumstances it should leave national borders. These questions are no longer confined to technology policy, they have become matters of economic policy, national security, industrial development and international trade.
Nigeria is no exception. As businesses increasingly migrate to cloud infrastructure and digital platforms become central to commercial activity, questions surrounding data localisation have become more prominent. Financial institutions, telecommunications operators, healthcare providers, public institutions and multinational companies are all grappling with how best to manage data within an increasingly complex regulatory environment.
Yet, despite the growing attention the topic has received, one misconception persists: that Nigeria has a single data localisation law requiring all data generated within Nigeria to remain in Nigeria.
It does not.
Rather than imposing a single comprehensive data localisation law, Nigeria’s approach is evolving through legislation, sector-specific regulation, technical standards and government policy, each addressing different categories of data and different regulatory objectives. Recent initiatives by the Central Bank of Nigeria (CBN) and the National Information Technology Development Agency (NITDA) demonstrate that this framework continues to develop as policymakers seek to balance digital sovereignty, cybersecurity, innovation and cross-border digital commerce.
Understanding that framework, and, perhaps more importantly, recognising the direction in which it continues to evolve, is becoming increasingly important for businesses operating in Nigeria.
Why is Data Localisation Receiving Increased Attention?
Data has become one of the most valuable commercial assets in the modern economy. At the same time, governments increasingly view certain categories of data as strategic national assets. Several factors have contributed to this shift.
First, concerns around cybersecurity have heightened the importance of maintaining control over sensitive data and critical digital infrastructure.
Secondly, rapid advances in artificial intelligence have increased the strategic value of access to large datasets, prompting governments to reconsider how national data resources should be managed.
Thirdly, geopolitical developments have highlighted the risks associated with over-reliance on foreign digital infrastructure, encouraging many countries to strengthen domestic digital capabilities.
Finally, the continued expansion of cloud computing has made it easier than ever for data to move across multiple jurisdictions, raising new questions regarding regulatory oversight, accountability and jurisdiction.
Against this backdrop, the conversation has evolved beyond privacy. Increasingly, it concerns digital sovereignty, economic resilience and national competitiveness.
Does Nigeria Have a Data Localisation Law?
The short answer is no. However, the position is more nuanced than that simple answer suggests. Nigeria has not adopted a single, comprehensive data localisation law requiring all data generated within the country to be stored exclusively in Nigeria. Instead, the legal framework consists of multiple legislative instruments, sector-specific regulations, technical standards and government policies addressing different aspects of data governance.
These include:
- the Nigeria Data Protection Act 2023;
- the General Application and Implementation Directive (GAID) 2025;
- the National Cloud Computing Policy (2019);
- sector-specific requirements issued by regulators such as the Central Bank of Nigeria, the Nigerian Communications Commission, the National Health Insurance Authority and other public institutions; and
- procurement and public sector policies relating to government information systems.
Viewed collectively, these instruments demonstrate that Nigeria has adopted a layered regulatory approach rather than a single comprehensive localisation statute. In practice, localisation obligations depend on the nature of the data, the sector involved, the applicable regulator and, increasingly, broader policy objectives relating to national digital infrastructure and sovereign cloud capabilities.
Data Localisation and Data Residency Are Not the Same Thing
One of the most common sources of confusion is the tendency to use the terms data localisation and data residency interchangeably. Although closely related, they describe different concepts. Data residency simply refers to the jurisdiction in which data is stored. Data localisation goes further by requiring certain categories of data to be stored, or in some cases processed, within a specified jurisdiction, often accompanied by restrictions on transfers outside that jurisdiction.
A company may, for example, choose to host customer data within Nigeria for commercial reasons while maintaining encrypted backup copies overseas. Depending on the applicable legal and regulatory framework, that arrangement may satisfy residency objectives without constituting strict localisation.
Understanding this distinction is important because many organisations assume that local hosting automatically satisfies localisation requirements. In reality, the legal analysis often depends on whether cross-border transfers occur, the safeguards applied and the nature of the data involved.
The NDPA and Cross-Border Transfers
Contrary to popular perception, the Nigeria Data Protection Act does not impose a general prohibition on transferring personal data outside Nigeria. Instead, it regulates such transfers through a framework based on adequacy, appropriate safeguards and accountability.
Organisations remain responsible for ensuring that personal data transferred outside Nigeria continues to receive an appropriate level of protection, whether through adequacy decisions, contractual safeguards or other recognised transfer mechanisms.
The GAID provides additional guidance regarding the implementation of these obligations and clarifies the expectations placed on data controllers and processors.
For many organisations, therefore, compliance with the NDPA is less about determining whether data may leave Nigeria and more about ensuring that appropriate governance and transfer mechanisms are in place before it does.
The NDPA provides the foundation for Nigeria’s data governance framework, but it is no longer the whole story. Increasingly, sector regulators and policymakers are supplementing the Act through targeted localisation requirements, technical standards and broader digital economy policies. These developments will be examined in Part Two of this series.
