Why Nigeria’s data-localisation drive must prioritise security, resilience and governance, not server location alone.
Opinion Article | By Dr Rex Abitogun
Nigeria has good reasons to pursue digital sovereignty: greater control over critical digital infrastructure, better protection of sensitive information and a stronger domestic cloud economy. The test now is implementation. From 1 January 2027, financial institutions and federal public institutions will enter related but distinct implementation regimes governing the domestic storage, management and classification of important data. How Nigeria implements these requirements will determine whether the policy delivers on its promise.
A recent readiness assessment raises a warning for regulators, board members and technology professionals. According to the National Information Technology Development Agency (NITDA), a joint survey with the Central Bank of Nigeria (CBN) assessed implementation readiness for the Nigerian Sovereign Cloud Initiative. Only 26 of 44 responding financial institutions (59 per cent) had completed, or were likely to complete, the required actions before the deadline. The survey was self-reported and was not a compliance assessment, so the finding concerns the respondents, not necessarily the entire industry. It is not an argument against data localisation; it is an argument for disciplined implementation that strengthens digital resilience and economic security.
Nigeria’s dependence on foreign digital infrastructure creates genuine economic and national security exposure. Critical services can be affected by international connectivity failures, external policy decisions or contractual arrangements beyond the immediate reach of Nigerian authorities. Domestic cloud capacity can support jobs, retain expenditure, improve regulatory access and strengthen resilience. Those benefits do not make server location a guarantee of security. A poorly configured database can be breached even when it is hosted in Nigeria. A local provider without adequate disaster recovery can suffer a prolonged outage. And concentrating essential financial workloads among a few providers may simply replace foreign dependency with domestic systemic risk. Localisation must therefore be judged by the risks it reduces, not just the workloads it relocates.