Data Localisation in Nigeria: What Must Stay in the Country, and What Can Leave (2026 Guide)

Last checked: 18 October 2026. This guide explains the rules. It isn’t legal advice, so for a specific system get a Nigerian data protection lawyer to review it.

The short answer

Nigeria has no single law that says all data must stay in the country. The main privacy law, the Nigeria Data Protection Act 2023 (NDPA), lets you send personal data abroad. You need adequate protection on the other side (an adequacy finding, binding corporate rules, contract clauses, a code of conduct or a certification), or one of a short list of exceptions such as informed consent. You also have to write down which basis you used.

Hard localisation (data that must be stored in Nigeria) comes from sector rules:

• Payment transaction data. A Central Bank of Nigeria (CBN) circular dated 15 June 2026 requires payment transaction data generated in Nigeria to be “stored and managed in Nigeria” from 1 January 2027. The CBN said in October 2026 that the deadline will not move.
• Domestic card, POS and ATM transactions must go through a local switch and must never be routed abroad for switching. This rule dates back years.
• Telecom subscriber information can’t leave Nigeria without the Nigerian Communications Commission’s (NCC) prior written consent.
• Government (“sovereign”) data must be hosted in Nigeria under NITDA guidelines unless NITDA approves otherwise. The new National Digital Cloud Policy (August 2026) adds a four-level classification. Its sovereignty part still awaits presidential approval.

If you break the NDPA, the fine can reach the greater of ₦10 million or 2% of the previous year’s gross revenue for “major importance” organisations. Enforcement has already happened: MultiChoice Nigeria was fined ₦766 million in 2025, partly for unlawful cross-border transfers.

The rest of this guide covers each rule, what is binding and what is only guidance, the open questions, the hosting options inside Nigeria, and a checklist.

Localisation, residency and transfer rules: three different things

People use these words loosely, but they mean different things, and Nigeria uses all three.

• Data localisation: the data must be stored, and sometimes processed, inside the country. The CBN’s domestic switching rule and the payments circular work this way.
• Data residency: a copy must sit in the country, but access or processing from abroad may be allowed. The “Highly Sensitive” tier of the new cloud policy works roughly like this: data stays at rest in Nigeria, and processing abroad can happen in approved environments.
• Conditional transfer: the data can leave if conditions are met. This is the NDPA’s model for ordinary personal data, and it’s the same family of rules as the EU’s GDPR.

Keep the distinction in mind. “We use a Lagos data centre” can satisfy a residency rule and still fail a localisation rule if your processing, backups or admin access run abroad.

Who regulates which data

One dataset can fall under several regimes. A fintech’s transaction log is personal data under the NDPA, payment transaction data under the CBN circular, and possibly “regulated data” under the cloud policy. Apply the strictest rule that covers each data element.

The instruments at a glance: what is binding and what is guidance

Instrument	Issuer	Legal force	What it says about location
Nigeria Data Protection Act 2023, ss. 41–43	National Assembly	Binding statute	Transfers allowed with adequacy, an approved instrument or a s.43 exception. Record the basis.
General Application and Implementation Directive (GAID) 2025, Art. 45 and Schedule 5	NDPC	Binding subsidiary instrument under the NDPA	Explains how to assess adequacy. In force since 19 September 2025.
CBN circular PSS/DIR/PUB/CIR/001/004 (15 June 2026)	CBN	Binding on CBN-licensed institutions	Payment transaction data generated in Nigeria stored and managed in Nigeria from 1 January 2027
CBN Guidelines on Operations of Electronic Payment Channels (2016, revised 2020)	CBN	Binding on payment industry	Domestic transactions switched locally, never routed abroad
NCC (Registration of Telephone Subscribers) Regulations 2011, reg. 10(4)	NCC	Binding regulation	No subscriber information transferred abroad without NCC’s written consent
Guidelines for Nigerian Content Development in ICT (amended 2019), ss. 11–13	NITDA	Guideline issued under the NITDA Act. How far it binds private firms is debated.	Sovereign data hosted in Nigeria. Telcos and network companies host subscriber and consumer data in Nigeria.
National Digital Cloud Policy (August 2026)	Federal Ministry of Communications / NITDA	Policy. Sovereignty part (Part III) pending presidential approval.	Four-level classification for government and designated regulated data
NDPR 2019 and its Implementation Framework	NITDA	No longer in effect since GAID took effect, per DLA Piper’s GAID briefing	Its old transfer whitelist is gone

On NITDA’s guidelines, section 8.0 says any breach “shall be construed as a breach of the provisions of the NITDA Act of 2007”. Section 4.0 says they apply to private businesses as well as government agencies. We found no court decision testing the hosting provisions against a private company, so how far they reach outside government work is uncertain. For government suppliers the question doesn’t matter much, because the requirement ends up in the contract.

The default rule: the NDPA and GAID 2025

Who the NDPA covers

Section 2 of the NDPA applies when the controller or processor is based or operating in Nigeria, when the processing happens in Nigeria, or when a foreign company processes the personal data of people in Nigeria. A US or European SaaS company with Nigerian users is covered even without a Nigerian entity.

When personal data may leave Nigeria

Section 41(1) is the core rule. Here it is in the Act:

So a transfer is lawful when either:

1. The recipient gives adequate protection. That means it is bound by “a law, binding corporate rules, contractual clauses, code of conduct, or certification mechanism” giving protection substantially similar to the NDPA (s.41(1)(a), s.42(1)). Section 42(2) lists what counts: enforceable rights and redress, an independent regulator, an effective data protection law, public authorities’ access to data, international commitments, and any agreement between the NDPC and the foreign regulator.
2. A section 43 exception applies. There are six: the person consented after being told the risks, the transfer is needed for a contract with them, it is for their sole benefit and consent isn’t practicable, important public interest, legal claims, or vital interests when they can’t consent.

Two duties people miss:

• Record it. Section 41(2) requires you to record the basis for each transfer and why protection is adequate. Practitioners recommend that major-importance organisations also describe their transfer approach in the annual compliance audit return.
• Watch for extra restrictions. Section 41(4) lets the NDPC designate categories of personal data that face stricter transfer rules. As of October 2026 we found no such designation, but the power exists.

What GAID 2025 added

The NDPC issued the General Application and Implementation Directive (GAID) on 20 March 2025, and it took effect on 19 September 2025. DLA Piper’s summary says GAID:

• lists the factors the NDPC weighs for adequacy (Schedule 5) but names no approved countries;
• requires NDPC approval for transfers that rely on binding corporate rules or standard contractual clauses;
• ends the NDPR 2019, including the old NDPR “whitelist” of countries. One law firm reports that the whitelist was successfully challenged in court in Ikigai v NITDA (FHC/ABJ/CS/1246/2022). We could not check the judgment ourselves.

Commentators writing in May 2026 said the NDPC still hadn’t issued a standard cross-border transfer instrument, so most companies rely on contract clauses plus a documented adequacy assessment. Consent is a weak foundation for routine transfers, because people can withdraw it at any time.

We could not read GAID directly. The NDPC’s website (ndpc.gov.ng) returned “403 Forbidden” from our location throughout this research. The GAID points above come from law-firm summaries. Check Articles 44–45 and Schedule 5 against the official text before you rely on them.

Do you have to register?

“Data controllers and processors of major importance” must register with the NDPC (s.44), appoint a Data Protection Officer (s.32) and file annual compliance audit returns. The NDPC sets the thresholds by guidance, based on how many people’s data you process and the sector. Being “of major importance” doesn’t change whether you may transfer data. It does set your maximum fine (see Penalties).

Sector-by-sector requirements

This is the table we wanted when we started. Each row says what must happen, where the rule comes from, and how firm it is.

Data type	Requirement	Source	Legal force	Applies to	Status (Oct 2026)
Any personal data	May leave with adequate protection or a s.43 exception. Record the basis.	NDPA ss.41–43. GAID Art. 45, Sch. 5.	Binding	All controllers and processors, including foreign ones serving Nigerians	In force
Payment transaction data generated in Nigeria	Stored and managed in Nigeria	CBN circular PSS/DIR/PUB/CIR/001/004, 15 June 2026	Binding on licensees. Reaches others through contracts.	Banks, microfinance banks, mobile money operators, switches, terminal and payment solution providers, super agents, other payment participants	Compliance from 1 Jan 2027
Domestic card, POS, ATM and mPOS transactions	Switched by a local switch, never routed abroad for switching	CBN e-payment channels guidelines, 2.4.1.6, 2.4.4.8, 3.4.3.6	Binding	Acquirers, processors, card schemes	In force since 2016. Kept in the 2020 revision.
Bank Verification Number (BVN) data	Stored in Nigeria	CBN Regulatory Framework for BVN Operations (as described by Banwo & Ighodalo)	Binding	Banks and licensed financial institutions	In force (we did not read the framework itself)
Telecom subscriber registration information	No transfer abroad without NCC’s prior written consent	NCC Registration of Telephone Subscribers Regulations 2011, reg. 10(4)	Binding	NCC licensees	In force
Telecom and network subscriber and consumer data	Host in Nigeria	NITDA Nigerian Content Guidelines 11.1(4), 12.1(4)	Guideline	Telcos, networking and internet service companies	In force
Government (“sovereign”) data	Host in Nigeria. Abroad only with NITDA’s express approval.	NITDA Guidelines 13.1(2), 13.2(3)	Guideline (contractual for suppliers)	Data management firms serving government, federal agencies	In force
Government and designated regulated data, by tier	Level 4: domestic only. Level 3: at rest in Nigeria with a domestic backup. Level 2: hybrid with approval. Level 1: no limit.	National Digital Cloud Policy, Part III	Policy, pending presidential approval	Federal agencies. Private firms only if their data is formally designated.	Adopted Aug 2026. Sovereignty part not yet in force.
Health, insurance, pensions, capital markets	No specific localisation rule found. The NDPA applies.	n/a	n/a	n/a	Check with your sector regulator

On the last row: Chambers and other commentators list the National Health Insurance Authority among regulators that may impose location rules. We searched NHIA, NAICOM, PenCom and SEC material and found no published hosting requirement. Absence of evidence isn’t proof, so ask your regulator, and check whether your data could be designated “Highly Sensitive” (financial, health, biometric, identity) once the cloud policy’s sovereignty part is approved.

Payments: the CBN’s June 2026 circular

This is the rule causing the most work right now.

What it says

On 15 June 2026 the CBN issued circular PSS/DIR/PUB/CIR/001/004. It covers market structure, data localisation, beneficial ownership disclosure and systemic oversight. According to Aluko & Oyebode’s summary of the circular, all financial institutions and “participants facilitating payments within Nigeria must ensure that payment transaction data generated within Nigeria are stored and managed in Nigeria”, with compliance required from 1 January 2027.

The circular is addressed to deposit money banks, microfinance banks, mobile money operators, switching and processing companies, payment terminal service providers, payment solution service providers, super agents and other licensed operators. If you’re an unlicensed fintech or SaaS vendor that touches payment data for a licensed partner, expect the duty to reach you through your contract.

The same circular caps market share. A firm with more than 25% of consumer issuing can’t hold more than 15% of merchant acquiring, and the reverse also applies, by 31 December 2026. Licensees must also file monthly market-share returns.

The CBN won’t extend the deadline

At an industry roundtable in Lagos in October 2026, the CBN’s Payments System Supervision director, speaking through a representative, said: “The compliance date hasn’t changed. It’s 1st of January, 2027.” She also said “This calls for a complete data audit”. Her advice was to audit and classify the data first, then agree the local architecture and contracts, then test and verify. She said the work covers the full data lifecycle, from creation to disposal.

What the circular doesn’t say

Lawyers and practitioners agree on the gaps:

• Does a foreign cloud’s local zone count? The circular doesn’t say whether “an international cloud provider’s local availability zone in Nigeria” satisfies it (Aluko & Oyebode).
• Disaster recovery abroad? Offshore DR sites, group-shared technology and international remittance operators aren’t addressed.
• Is a synced copy enough? A fintech practitioner writing in Daily Trust points out that “stored and managed” is undefined. It’s unclear whether a synchronised copy in Nigeria is enough or the primary system must be local, and no recovery objectives, audit requirements or penalty schedule are set.

Until the CBN clarifies, the safe reading is this: your primary payment database, its backups, logs and analytics copies all sit in Nigeria, and so do the people and systems that “manage” them. Treat offshore replicas as a compliance risk, not a grey area.

The older payment rules still apply

The switching rule is much older and much stricter. Section 2.4.4.8 of the CBN’s e-payment channels guidelines reads:

Clause 2.4.1.6 applies the same rule to merchant acquirers, and 3.4.3.6 applies it to mPOS. Card schemes also can’t force a Nigerian issuer or acquirer to send a domestic transaction abroad for processing. Separately, BVN data must stay in Nigeria under the CBN’s BVN framework, and a 2024 presidential order designates BVN, NIN and NIBSS systems as critical national information infrastructure.

Government and “sovereign” data

NITDA’s Nigerian Content Guidelines

Section 13.1(2) of NITDA’s Guidelines for Nigerian Content Development in ICT is the main hosting rule for government data:

Approval depends on conditions including government’s “unfettered right to access and retrieve its data wherever it is located”, a non-disclosure undertaking, NITDA review of your security process, the government’s choice of jurisdiction, and periodic third-party audits. Section 13.2(3) tells federal agencies to “ensure that all sovereign data is hosted locally on servers within Nigeria”. Section 12.2(1) requires them to host their websites locally on a .gov.ng domain.

The guidelines never define “sovereign data”. In practice, read it as data that government bodies create or hold.

The National Digital Cloud Policy (August 2026)

The Federal Government unveiled the National Digital Cloud Policy in August 2026. It replaces the 2019 Nigeria Cloud Computing Policy. According to OAL’s review on Afriwise, it sorts “sovereign data” into four levels:

Level	Class	Hosting requirement
4	Classified (national security, critical infrastructure)	Only in Nigeria, under sovereign control
3	Highly Sensitive (regulated financial, health, biometric, identity data)	Stored at rest in Nigeria. Processing in approved environments.
2	Sensitive	Hybrid, including approved international infrastructure, with authorisation
1	Open	No residency restriction

Two points matter for private companies. First, the sovereignty rules cover government data and regulated data that is formally designated under federal regulation, licence or directive. Ordinary commercial data stays under the NDPA. Second, Part III (sovereignty) only takes effect after presidential approval, and designating data at Level 3 or 4 needs presidential approval on the Federal Executive Council’s recommendation. As of our check we found no report that this approval had been given.

Telecoms subscriber data

Regulation 10(4) of the NCC’s 2011 subscriber registration regulations is short and absolute: “No subscriber information shall be transferred outside the Federal Republic of Nigeria without the prior written consent of the Commission.” (NCC Regulations 2011). The subscriber’s consent doesn’t help here. The NCC’s does. NITDA’s guidelines go further and tell telcos and networking companies to host “all subscriber and consumer data within the country”.

If you’re a value-added service provider, a CPaaS platform or an analytics vendor working with a mobile network operator, expect these terms in your contract.

Penalties and enforcement so far

Under section 48 of the NDPA, the NDPC can order you to fix the breach, pay compensation, give up profits from the violation, or pay a penalty of up to:

• the higher maximum for major-importance organisations: the greater of ₦10,000,000 or 2% of annual gross revenue in the previous financial year;
• the standard maximum for everyone else: the greater of ₦2,000,000 or 2%.

When setting the amount, the NDPC weighs factors including cooperation (s.48(6)). Failing to comply with an NDPC order is a criminal offence, with a fine or up to one year in prison (s.49). You can ask a court for judicial review within 30 days of an order (s.50).

The CBN circular sets no penalty schedule of its own. A practitioner writing in Daily Trust notes it leaves sanctions to the CBN’s discretion.

Enforcement actions with a cross-border or cooperation angle:

When	Organisation	Regulator	Amount	Why
Aug 2024	Fidelity Bank	NDPC	₦555.8m (0.1% of 2023 gross revenue)	Account opened with a person’s data without lawful basis. Penalty aggravated by lack of cooperation.
Feb 2025	Meta (Facebook, Instagram)	NDPC	$32.8m	Behavioural advertising without valid consent and transfers of Nigerians’ data abroad without approval. Settled out of court. The Federal High Court adopted the settlement in late 2025, and its terms were not disclosed.
Jul 2025	MultiChoice Nigeria	NDPC	₦766.2m	Invasive processing and “illegal cross-border transfer of personal data relating to data subjects in Nigeria”. Earlier corrective directive not met.
Aug 2025	1,369 companies	NDPC	n/a	21-day demand to banks, insurers, pension firms and gaming operators for audit returns, DPO details and registration

Two patterns stand out. Cross-border transfers appear in the two biggest NDPC cases. And in both the Fidelity and MultiChoice cases, the NDPC said that failing to cooperate made things worse. The NDPC has also been criticised for slow and opaque handling of some breach complaints. In July 2026 the investigative outlet FIJ documented three reported cases with no visible outcome. So enforcement is real, but you can’t predict it.

Can this data leave Nigeria? A decision flow

Hosting inside Nigeria: what’s actually available

The big clouds

As of October 2026, none of AWS, Microsoft Azure or Google Cloud runs a full cloud region in Nigeria. We found no announcement of one. The nearest full regions are in South Africa (AWS in Cape Town, Azure and Google in Johannesburg).

AWS does have a Local Zone in Lagos (af-south-1-los-1a), launched in January 2023. A Local Zone extends a parent region, here Cape Town (af-south-1). It isn’t a region of its own. AWS’s Local Zones feature table lists what runs in Lagos:

Available in the Lagos Local Zone	Not listed for Lagos
EC2 (T3, C5, R5, G4dn, M5)	Amazon S3
EBS (gp2 volumes only)	Amazon RDS
Application Load Balancer, Shield Standard	ElastiCache
ECS, EKS, VPC	NAT Gateway
Direct Connect, Application Migration Service, AWS DRS	EMR, FSx
Route 53 geoproximity routing

That gap matters for localisation. Without S3 or RDS in Lagos, a “local” AWS design means running your own databases on EC2 and EBS, and making sure nothing (snapshots, logs, object storage) falls back to Cape Town by default. The control plane also sits in the parent region. Whether that satisfies “stored and managed in Nigeria” is exactly the open question the CBN hasn’t answered.

Local data centres and clouds

Nigeria has more than 21 colocation and enterprise data centres, according to BusinessDay, including Rack Centre, Equinix’s MDXi and Africa Data Centres. Open Access Data Centres, Digital Realty and MTN also operate in Lagos, where most capacity sits. There’s a growing set of local cloud providers (Nobus, Layer3, Galaxy Backbone, Nebula, Suburban, GigaLayer among them). Capacity is the worry. A practitioner estimate puts live commercial capacity at about 50–56 MW, with 124–137 MW once announced and under-construction projects are counted (Daily Trust). That is small next to the demand the payments migration could create, and grid power is unreliable, so facilities depend on their own generation.

Latency

Hosting abroad isn’t only a legal question. It’s also slower for users in Nigeria. We pulled public ping data from a Lagos test server:

The surprise for many teams: from Lagos, London (104 ms) is faster than Johannesburg (167 ms) or Cape Town (240 ms), because subsea cables run along the west coast to Europe. If you moved to Cape Town for “African data residency”, your users may have taken a latency hit for no legal gain, since South Africa is still “abroad” under every Nigerian rule. Hosting in Lagos usually gives the best latency for Nigerian users, provided your users’ networks peer locally. One engineer on Hacker News noted that weak local peering can still send traffic between Nigerian networks through London or Marseille.

Cost

Currency risk can be as big as the hosting bill itself. Fara Ashiru, founder of the fintech Okra, told Rest of World she paid AWS in dollars while earning in naira, and as the naira fell about 70% between 2020 and 2024, “The bills were staggering.” Okra moved to its own servers in Nigeria and South Africa. Another founder who moved to a local provider found it lacked AWS-style automation: “I have to manually integrate our system gradually.” AWS began accepting naira in January 2025, which removes some of the currency problem but not the location problem.

How companies are complying in practice

From the people doing the work, a few patterns emerge:

• Banks split the stack. Kenneth Ufomba, MD of the systems integrator SATH, told Nairametrics that “Most of the top tier banks have complied with this over the years”. In his account they use global clouds while keeping the regulated data categories local. He expects cloud-native fintechs to find the CBN rule harder.
• Hybrid architectures. The common design keeps the core payment engine, transaction database, backups and logs in a Nigerian facility, and leaves non-regulated workloads (marketing site, internal tools, anonymised analytics) on global clouds.
• Data mapping first. Every law firm we read, and the CBN itself, starts with an inventory: what data, where it’s stored, processed, backed up and accessed from.
• Contracts as the enforcement path. Licensed banks push localisation clauses onto their fintech, SaaS and processor partners, and NCC licensees do the same for telecom data.
• Scepticism about readiness. Practitioners argue the six-and-a-half-month window is too short. They point to India’s 2018 payments localisation order, which took years to enforce fully. The CBN’s answer so far has been that the date stands.

Compliance checklist

Use this as a working list. Items marked (payments) matter only if you handle payment data.

1. Map your data (weeks 1–2)
– List every dataset holding Nigerian personal data, payment data, subscriber data or government data.
– For each, record where it’s stored, processed, backed up and logged, and where it’s accessed from, including vendor support access.
– Tag each dataset with every rule in the sector table above that applies.

2. Fix your legal basis for transfers
– For each cross-border flow, record the NDPA s.41 basis and your adequacy reasoning (s.41(2)).
– Put data processing agreements with transfer clauses in place with every foreign vendor.
– If you rely on binding corporate rules or standard clauses, check whether GAID requires NDPC approval for your instrument.
– Don’t use consent as the default basis for routine transfers.
– If you’re a major-importance organisation: confirm registration, DPO, and that transfers appear in your annual audit return.

3. Localise what must be local
– (payments) Move primary payment transaction databases, replicas, backups, logs and analytics exports to Nigeria before 1 January 2027.
– (payments) Confirm domestic card, POS and ATM switching runs through a local switch.
– (payments) Decide your position on DR. Ideally put a second site in Nigeria, not offshore.
– (telecoms) Get NCC written consent before any subscriber information leaves Nigeria.
– (government work) Host sovereign data in Nigeria or obtain NITDA’s express approval in writing.

4. Choose hosting deliberately
– Shortlist Nigerian facilities and clouds. Check their certifications (for payments, PCI DSS), power redundancy, and that their own backups are in Nigeria.
– If you use a hyperscaler’s Lagos presence, check which services actually run locally. Make sure defaults don’t put snapshots, object storage or logs in the parent region.
– Test latency from your users’ networks, not just from your office.
– Price in naira where you can, or model the currency risk.

5. Prove it
– Keep architecture diagrams, data-flow maps and vendor attestations showing location.
– Run a migration test and an independent check well before 1 January 2027, when the CBN says it will start reviewing compliance.
– Assign an owner to watch for CBN clarifications, NDPC adequacy decisions and presidential approval of the cloud policy’s sovereignty part.

How Nigeria compares with other African countries

Country	General personal data	Hard localisation
Nigeria	Transfers allowed with adequacy or exceptions (NDPA ss.41–43)	Payments (CBN, 2027), switching, BVN, telecom subscriber data, government data
Kenya	Transfers allowed with safeguards	Regulation 26 of the Data Protection (General) Regulations 2021: data processed for the state’s “strategic interest” (civil registration, elections, public finance, protected systems, basic education) must be processed in Kenya or keep at least one serving copy there
South Africa	Transfers governed by POPIA s.72	Government data must reside in South Africa under the 2022 public-service cloud directive. No general localisation rule for private-sector personal data.
Rwanda	Transfers allowed on listed grounds	Law 058/2021, article 50: personal data must be stored in Rwanda unless the controller holds a certificate allowing storage abroad

Nigeria sits in the middle. It’s stricter than South Africa because of the payments rule, and looser than Rwanda for ordinary personal data.

FAQ

Does the Nigeria Data Protection Act require data localisation?
No. It restricts transfers abroad but allows them with adequate protection or under a section 43 exception. Localisation comes from CBN, NCC and NITDA rules and from government policy.

Can I keep Nigerian customers’ data on AWS, Azure or Google Cloud abroad?
For ordinary personal data, yes, if you have a lawful transfer basis, contract terms with the provider, and a written adequacy assessment. For payment transaction data generated in Nigeria, not after 1 January 2027. For telecom subscriber information, not without NCC consent.

Does the AWS Lagos Local Zone make me compliant with the CBN rule?
Nobody can say yet. The circular doesn’t address foreign providers’ local zones. The Lagos zone lacks S3 and RDS, and its control plane is in Cape Town. If you use it, keep every copy of payment data on resources physically in Lagos and get written confirmation from your regulator or counsel.

Is a backup or disaster recovery site abroad allowed for payment data?
The circular doesn’t say. Lawyers have flagged offshore DR as an open question. Until the CBN clarifies, plan for backups in Nigeria.

Does remote access from abroad count as a “transfer”?
The NDPA doesn’t define transfer in a way that settles this. Many practitioners treat access from abroad (support engineers, a foreign head office) as a transfer. The cautious approach is to cover it with the same documented basis.

Is consent enough to send data abroad?
Only when there’s no adequate protection, and only if the person was told the risks first (s.43(1)(a)). Consent can be withdrawn, so it’s a poor basis for core systems.

Is there a list of “adequate” countries?
Not as of October 2026. The NDPR whitelist ended with GAID, and the NDPC has published adequacy factors but no country list.

I’m a foreign company with no office in Nigeria. Does this apply to me?
The NDPA does, if you process personal data of people in Nigeria (s.2(2)(c)). The CBN and NCC rules apply to their licensees, and to you indirectly through contracts if you work with one.

What is “sovereign data”?
NITDA’s guidelines don’t define it. The new cloud policy uses it for government data and for regulated data formally designated by federal regulation, licence or directive.

What’s the fine for getting it wrong?
Under the NDPA, up to the greater of ₦10 million or 2% of annual gross revenue for major-importance organisations (₦2 million or 2% for others), plus compensation and remedial orders. Ignoring an NDPC order is a criminal offence.

Is anything else coming?
Watch three things: CBN guidance on the payments circular, presidential approval of the cloud policy’s sovereignty part, and the National Digital Economy and E-Governance Bill. As of October 2026 we found no record that the bill had been signed.

---

Sources were checked on 18 October 2026. Rules in this area change quickly, so recheck the CBN, NDPC and NITDA positions before acting. This article is general information, not legal advice.