CBN · NDPC · Cloud Compliance

The Localisation Era Has Arrived: What Nigeria's Data Residency Rules Mean for Your Cloud Stack (2026 Compliance Guide)

By Seun Adeyemi, Business Manager, License Advisory Limited

Let me ask you a question I have been asking founders all month: right now, where is your customers' data actually sitting?

Most people answer "the cloud," as if the cloud is a place. It is not. It is somebody else's computer — usually in Ireland, Virginia, or Frankfurt. Your customer opens your app in Surulere, but her data sleeps in Dublin.

For years, nobody asked questions about this. Those days are ending fast.

What is Nigeria's new data localisation mandate?

In one sentence: the Central Bank of Nigeria has directed that all payment and financial transaction data created in Nigeria must be processed, stored, and managed inside Nigeria by January 1st, 2027 — while the Nigeria Data Protection Act already prohibits cross-border transfers of personal data by default unless proper safeguards are in place.

Two things happened this year. Pay attention to both.

First, the CBN dropped a mandate. In June 2026, the Central Bank issued a directive that all payment and financial transaction data created in Nigeria must live in Nigeria. The deadline is January 1st, 2027. Not a suggestion. A deadline — and as I write this, you have less than six months.

Second, the NDPC told us where the wind is blowing. The National Commissioner of the Nigeria Data Protection Commission said it plainly this year: Nigeria records over 4,000 cyberattacks every week, and the country must take deliberate steps to ensure data generated here is stored and processed here. He called it digital sovereignty. I call it a preview. When two regulators start singing the same song, wise operators learn the lyrics early.

And underneath both sits a law many businesses have never properly read: the Nigeria Data Protection Act (NDPA). Under the NDPA and its implementation directive, moving personal data out of Nigeria is prohibited by default unless you have proper safeguards in place. Read that again. Prohibited by default. The question is not whether there is a rule — it is what permission you have.

"But we're not sending data anywhere" — the cloud compliance blind spot

I hear this every week, and every week I have the same conversation. So let me have it with you.

Do you run your app on AWS, Azure, or Google Cloud? Do you use Google Workspace for company email? Do you push customer records into a CRM built in America? Do you call a foreign API every time a user signs up?

Then you are transferring data across borders. Every database query, every API call, every email — if the server is outside Nigeria, that is a cross-border transfer under the law, and each one needs documented safeguards. When compliance reviews are done on Nigerian fintechs, it is common to find ten, fifteen undocumented international transfers before lunch. Not because anyone is a criminal. Because nobody told them that "cloud infrastructure" is a legal event, not just a technical one.

I have lived this from the inside — years spent chasing approvals through what I call death by a thousand doors. One client of ours, a lender, discovered during a licensing engagement that their entire customer database — BVNs, statements, everything — sat on a European server managed by a vendor they had never audited. Nothing bad had happened. Yet. When we mapped their data flows, the room went quiet. They fixed it in ninety days. Under the new CBN timeline, ninety days is a luxury you may not have.

What data residency rules mean for your business

Let me strip the jargon:

1. If you touch payments, your infrastructure decision has been made for you

Transaction data must live in Nigeria by January 2027. If your core systems run abroad, you are now in a migration project whether you planned one or not. Nigeria's data centre market is growing for exactly this reason — local options exist. The mistake is waiting until November to explore them.

2. Not all data must stay — but all data must be accounted for

Outside the CBN mandate, personal data can still lawfully leave Nigeria — through NDPC-recognised mechanisms like approved contractual clauses and adequacy-based transfers. But "lawfully" means paperwork: knowing what leaves, where it goes, and under what agreement. If a regulator asked you tomorrow to list every country your customer data touches, could you answer within the hour? That answer is the whole compliance posture.

3. This is a two-regulator problem — and that is the trap

The CBN directive and the NDPA regime overlap but are not identical. I have watched businesses satisfy one agency and get burnt by another — one arm saying yes while the other says no. The companies that will cross January without drama are the ones treating CBN and NDPC as one conversation, not two.

Data localisation compliance checklist: what to do this quarter

Map your data — this week. One honest workshop with your CTO: every system, every vendor, every server location. You cannot fix what you have not seen.
Separate the "must localise" from the "must document." Payment and transaction data goes on the migration list. Everything else goes on the safeguards list — contracts, transfer records, vendor agreements.
Start the localisation conversation now. Talk to local hosting providers, get quotes, understand timelines. Migration in September is a project. Migration in December is a panic.
Get your audit trail ready. When enforcement starts — and the fines already handed out under the NDPA tell you it will — the first request will be for your records, not your intentions.

Frequently asked questions

Does the CBN data localisation directive apply to my business?

If you create, process, or store payment or financial transaction data generated in Nigeria — as a bank, fintech, PSP, or licensed operator — yes. That data must be processed and stored within Nigeria by January 1st, 2027.

Is using AWS or Google Cloud illegal in Nigeria?

No — but if the servers are outside Nigeria, every movement of personal data to them is a cross-border transfer under the NDPA, which requires documented safeguards such as approved contractual clauses. And for payment and transaction data specifically, foreign hosting will not satisfy the CBN mandate after January 2027.

What are the penalties for non-compliance with the NDPA?

The NDPC has already issued substantial fines under the NDPA — running into hundreds of millions of naira for major violations including unlawful cross-border transfers. Beyond fines, non-compliance risks enforcement orders, reputational damage, and strained relationships with banking partners.

Where can I store data locally in Nigeria?

Nigeria's data centre market is expanding, with multiple local hosting and colocation providers now offering in-country infrastructure. The right choice depends on your workload, certifications required, and migration timeline — which is why the conversation should start now, not in December.

The bottom line: treat it as a six-month project, not a fire drill

Localisation is coming whether we argue about it or not. The businesses that treat it as a fire drill will pay in downtime, penalties, and lost bank relationships. The ones that treat it as a six-month project will cross into 2027 without breaking stride — and will win the customers who now ask, before signing anything: "where is my data?"

This is the same shift I have written about in Nigeria's Virtual Asset Council, in NUPRC's drill-or-drop warning to upstream operators, and in NIMASA's zero-tolerance vessel campaign: rules on paper are becoming enforcement in person. Data is simply the next surface.

We survived this system. We built through it. If you want help mapping your exposure before the deadline maps it for you, my team at License Advisory is one conversation away.