By Simpson Global Media News Desk
ANNOUNCEMENT DATE: Wednesday, 28 October 2026
ANNOUNCEMENT TIME: Exact time not confirmed.
VENUE: Executive Regulatory Dialogue on Data Localisation, Lagos State, Nigeria.
REPORT DATE: Friday, 30 October 2026.
POLICY IMPLEMENTATION DEADLINE FOR FINANCIAL INSTITUTIONS: 1 January 2027.
PROPOSED MDA DEADLINE: Not yet announced.
Government prepares wider data localisation requirements
Nigeria is preparing to extend data localisation requirements to federal ministries, departments and agencies (MDAs), following an assessment showing that 326 government institutions spent more than ₦3.8 trillion on technology between June 2023 and October 2026.
The Director-General of the National Information Technology Development Agency (NITDA), Kashifu Inuwa Abdullahi, disclosed the development during an Executive Regulatory Dialogue on Data Localisation organised jointly by NITDA and the Central Bank of Nigeria (CBN) in Lagos on Wednesday, 28 October 2026.
Abdullahi said the government was working with the Budget Office to establish a compliance deadline for MDAs.
The financial sector is being prioritised, with payment data localisation requirements scheduled to take effect on 1 January 2027.
The proposed extension to government institutions forms part of Nigeria's broader National Sovereign Cloud Initiative, which aims to strengthen domestic control over critical digital infrastructure, encourage local technology investment and reduce exposure to external disruptions.
The disclosure has placed government technology spending, cloud infrastructure, data security and digital sovereignty at the centre of discussions about Nigeria's technology future.
₦3.8 trillion technology expenditure across 326 MDAs
According to Abdullahi, NITDA's analysis found that 326 ministries, departments and agencies spent more than ₦3.8 trillion on technology between June 2023 and October 2026.
The amount represents substantial public-sector investment in information technology over approximately three years.
However, the agency did not provide a detailed breakdown showing how much of the expenditure went to cloud services, software subscriptions, hardware, foreign technology providers, data storage or other technology-related purchases.
The distinction is important because the ₦3.8 trillion figure should not be interpreted as money already spent on foreign cloud services.
Instead, NITDA is examining how government technology expenditure can be better coordinated, with the possibility of using shared cloud infrastructure to reduce duplication and improve efficiency.
Abdullahi argued that many government technology investments could be consolidated through cloud services.
He said this approach could make it easier and faster for MDAs to deploy digital services while improving the government's ability to coordinate technology procurement.
The government is therefore considering a more centralised approach in which institutions can use shared digital infrastructure rather than independently purchasing overlapping systems.
Why Nigeria wants more control over its data
Digital services have become essential to Nigeria's economy.
Banks process electronic payments, businesses conduct transactions online, government agencies maintain digital records and citizens increasingly depend on technology to access public services.
These activities rely on data centres, cloud platforms, telecommunications networks, cybersecurity systems and other digital infrastructure.
When critical services depend heavily on infrastructure located outside the country, disruptions in international connectivity, geopolitical tensions or problems affecting external technology providers could create operational risks.
NITDA's director-general said Nigeria needed stronger domestic capacity to maintain essential services during such disruptions.
He referred to the submarine cable disruptions experienced in 2024 as an example of how problems affecting international infrastructure can affect connectivity and digital services within the country.
The government argues that strengthening local infrastructure can help Nigeria maintain greater control over important systems and reduce excessive dependence on external providers.
The policy is also intended to create opportunities for Nigerian technology companies to participate more actively in the digital economy.
Financial institutions face January 2027 deadline
The financial sector is the first major area targeted by the current implementation programme.
The Central Bank of Nigeria has directed regulated financial institutions to localise critical payment transaction data in Nigeria by 1 January 2027.
The requirement is linked to the National Sovereign Cloud Initiative and the government's wider objective of strengthening the security and resilience of the financial system.
The financial sector has been prioritised because of its extensive use of digital technology.
Banks, fintech companies, payment service providers and other financial institutions process large volumes of sensitive information through digital platforms.
These systems support transfers, card transactions, mobile banking, merchant payments and other financial services.
The government believes that stronger domestic infrastructure and regulatory oversight can improve the country's ability to manage risks affecting these operations.
However, data localisation is not simply a matter of moving files from one country to another.
Financial institutions must examine their technology architecture, contracts, storage arrangements, cybersecurity systems, backup facilities and disaster-recovery procedures.
The transition also requires coordination between financial regulators, technology providers and institutions responsible for processing payments.
Readiness concerns among financial institutions
The October 2026 regulatory dialogue also revealed that several financial institutions were still working towards compliance.
Voice of Nigeria reported that findings presented by NITDA's Special Assistant on Digital Transformation, Muhammad Lawal, showed that 22 out of 44 financial institutions surveyed had yet to begin implementing the localisation requirements.
The report also said 26 institutions were on track to meet the January 2027 deadline, while 15 expressed concerns about their readiness.
These figures are not fully reconciled in the published report, which means they should not be treated as mutually exclusive categories or combined into a single readiness percentage.
The disclosures nevertheless show that implementation remains a significant task for the financial sector.
The CBN has indicated that regulatory engagement and guidance will be important in helping institutions address technical and operational challenges.
The regulator has also warned that deliberate non-compliance could attract sanctions.
CBN says cybersecurity must accompany localisation
The Deputy Governor of the Central Bank of Nigeria responsible for Financial System Stability, Lamido Yuguda, urged financial institutions to strengthen cybersecurity, operational resilience and risk management as they adopt domestic cloud infrastructure.
His warning highlights an important issue: storing data within Nigeria does not automatically make that data secure.
A local data centre can still be exposed to cyberattacks, insider threats, power interruptions, equipment failure and other operational problems.
Financial institutions must therefore maintain effective access controls, encryption, monitoring systems, backup arrangements and disaster-recovery plans.
They must also assess third-party technology providers and ensure that their systems can continue operating during disruptions.
The CBN's position is that data localisation should be accompanied by a broader framework for protecting financial services and the information they process.
CBN working to bring more of its own data into Nigeria
The Central Bank has also acknowledged that some of its secondary data remains outside Nigeria.
Rakiya Opemi Yusuf, Director of the CBN's Payments System Supervision Department, said a significant amount of the bank's data was already located in the country, while work continued to bring the remaining secondary data into Nigeria.
The disclosure illustrates that data localisation is an ongoing infrastructure and governance process, even for major public institutions.
The transition involves identifying the categories of information held by an institution, determining where that information is stored and ensuring that the systems handling it meet the relevant requirements.
The CBN's experience could provide lessons for other institutions expected to comply with future localisation rules.
What the National Sovereign Cloud Initiative means
The National Sovereign Cloud Initiative is intended to strengthen Nigeria's ability to manage and protect critical digital infrastructure.
Cloud computing allows organisations to access computing power, storage, software and other digital services through shared infrastructure rather than relying entirely on their own physical servers.
A sovereign cloud framework introduces additional requirements around the control, protection, location and governance of specified categories of data.
For Nigeria, the initiative is designed to improve domestic capacity while allowing both Nigerian and international technology providers to participate in the market.
It is not intended to require every piece of commercial data generated in Nigeria to remain within the country's borders.
The Federal Ministry of Communications, Innovation and Digital Economy clarified in its National Digital Cloud Policy, unveiled on 17 August 2026, that the framework does not impose general data localisation requirements on commercial data.
Instead, sovereignty requirements apply to defined categories of government and regulated data where national control is considered necessary.
This distinction is important for technology companies, international cloud providers and businesses that rely on cross-border data services.
National Digital Cloud Policy and government procurement
The Federal Government's National Digital Cloud Policy provides a wider framework for developing the country's cloud computing and data infrastructure ecosystem.
The policy identifies four major priorities:
Investment and market development: encouraging investment in data centres, cloud infrastructure, connectivity and artificial intelligence computing capacity.
Regional digital services exports: positioning Nigeria as a hosting and processing hub for West Africa and other African markets.
Government cloud transformation: improving government technology services through coordinated procurement and shared digital infrastructure.
Digital sovereignty and security: establishing proportionate safeguards for specified categories of government and regulated data.
The policy also proposes a National Digital Marketplace to support coordinated and transparent procurement of cloud and digital infrastructure services.
Through whole-of-government demand aggregation, the government intends to combine the technology requirements of multiple institutions.
The aim is to reduce duplicated expenditure, improve procurement terms and create more predictable demand for cloud infrastructure.
Such an arrangement could make it easier for technology companies to assess the market and decide whether to invest in Nigerian data centres and related services.
Opportunities for Nigerian technology companies
The proposed expansion of local cloud infrastructure could create opportunities for Nigerian technology businesses.
Potential areas include:
Data centre construction and operation.
Cloud storage and computing services.
Cybersecurity and digital risk management.
Backup and disaster-recovery systems.
Software development and government platforms.
Network infrastructure and connectivity.
Data management and regulatory compliance.
Artificial intelligence computing services.
Domestic providers could benefit if government procurement increasingly supports infrastructure located within Nigeria and capable of meeting the required technical standards.
The policy could also create employment opportunities for software engineers, cloud architects, data centre technicians, cybersecurity professionals and other specialists.
However, local providers will need to demonstrate reliability, security, technical capacity and competitive pricing.
The expansion of the market does not guarantee that every Nigerian technology company will automatically qualify to provide services to government institutions.
More than $850 million spent annually on cloud services
At the regulatory dialogue, Abdullahi said Nigerian businesses spend more than $850 million annually on cloud services.
He argued that some of the services and infrastructure purchased externally could be developed locally.
If domestic companies can provide reliable alternatives, more of the value generated by Nigeria's digital economy could remain within the country.
However, local investment requires more than policy announcements.
Data centres need reliable electricity, cooling systems, telecommunications connectivity, skilled workers, physical security and sufficient capital.
Cloud operators must also meet international standards for service availability, data protection and business continuity.
Nigeria's ability to expand its cloud market will therefore depend on whether local infrastructure can deliver the reliability and performance expected by major customers.
The challenge of electricity and infrastructure
One of the major challenges facing data centre development is the availability of reliable electricity.
Cloud infrastructure operates continuously and requires substantial energy to power servers, cooling equipment, security systems and supporting networks.
Power interruptions can affect service availability unless operators have adequate backup arrangements.
Data centre operators also require stable telecommunications connections, sufficient land, efficient cooling systems and access to technical professionals.
These requirements can increase operating costs and influence the price of services offered to customers.
The government's National Digital Cloud Policy recognises energy constraints and includes measures intended to facilitate investment in infrastructure.
However, the practical success of the policy will depend on how effectively these obstacles are addressed.
Cybersecurity and protection of sensitive information
Bringing data into Nigeria does not remove the need for strong data protection.
Government institutions hold information about citizens, public finances, national infrastructure and administrative operations.
Financial institutions also process sensitive customer and transaction information.
A breach involving such data could create serious consequences for individuals, businesses and public institutions.
The government will therefore need to ensure that data localisation is supported by appropriate security standards.
These include encryption, access restrictions, continuous monitoring, incident response procedures and independent assessments of technology providers.
Institutions must also establish clear arrangements for handling data breaches and restoring essential services following a cyber incident.
The National Digital Cloud Policy provides a framework for applying different requirements according to the sensitivity and classification of data.
This approach is intended to avoid treating every category of information as equally sensitive.
International providers will remain part of the market
Nigeria's approach does not exclude international cloud providers.
The Federal Ministry of Communications, Innovation and Digital Economy has stated that the National Digital Cloud Policy maintains an open, competitive and multi-provider market.
This means international companies can continue participating in Nigeria's digital infrastructure market, provided they comply with applicable rules.
The government's objective is to encourage investment, technology transfer and the development of domestic capacity rather than isolate Nigeria from global technology markets.
This approach could allow Nigerian businesses and public institutions to benefit from international expertise while strengthening local infrastructure.
The challenge will be ensuring that commercial partnerships support national data protection and security requirements.
What happens next?
The immediate priority remains the financial sector's 1 January 2027 payment data localisation deadline.
NITDA and the CBN are expected to continue engaging financial institutions, technology providers and other stakeholders to address implementation challenges.
For government ministries, departments and agencies, NITDA is working with the Budget Office to establish a compliance deadline.
As at 30 October 2026, no specific date for the wider MDA requirement had been announced.
The government is also expected to continue developing the shared cloud infrastructure and procurement arrangements outlined in the National Digital Cloud Policy.
For technology companies, the next phase will involve preparing to meet the infrastructure, security and service standards required by public-sector customers.
For financial institutions, the approaching deadline means that technical readiness, cybersecurity and business continuity will remain important priorities.
Nigeria's digital future depends on implementation
The disclosure that 326 MDAs spent more than ₦3.8 trillion on technology provides a picture of the scale of Nigeria's public-sector digital investment.
The government's proposed shift towards shared cloud infrastructure and stronger data localisation requirements could change how public institutions purchase, manage and protect technology.
It could also create opportunities for domestic data centre operators and technology companies.
However, the amount spent on technology is not itself proof of improved public services or stronger digital security.
The results will depend on how effectively the government coordinates its spending, enforces standards, protects sensitive information and ensures that domestic infrastructure can meet the needs of modern digital services.
Nigeria's ambition to strengthen digital sovereignty will therefore be judged not only by the policies announced but also by the reliability, security and efficiency of the systems eventually delivered.
Simpson Global Media will continue to follow the implementation of Nigeria's sovereign cloud policy, the January 2027 financial-sector deadline and the government's plans for public-sector data localisation.
Comments
Post a Comment