Keeping Data in Nigeria: On-Premises and In-Country Hosting Options Compared

# Keeping Data in Nigeria: On-Premises and In-Country Hosting Options Compared

TL;DR: Between the Nigeria Data Protection Act 2023's cross-border transfer rules, NITDA's sovereign-data hosting rules, and the CBN's June 2026 circular requiring payment transaction data generated in Nigeria to be stored and managed in Nigeria from 1 January 2027, "just use a cloud region in Europe" is no longer a safe default for regulated data. Here's how on-premises, colocation and local-cloud options stack up.

This article is general information, not legal advice.

Why this is suddenly urgent, not theoretical

For years, "data localisation" in Nigeria was something lawyers mentioned in footnotes. That changed in 2026. On 15 June 2026 the Central Bank of Nigeria issued circular PSS/DIR/PUB/CIR/001/004, which among other things requires payment transaction data generated within Nigeria to be stored and managed in Nigeria, in accordance with Nigerian data protection law, with compliance due by 1 January 2027. It applies to CBN-licensed payment system participants: banks, payment service providers, mobile money operators, switching and processing companies and other participants that facilitate payment transactions (Enebeli and Partners, Legal 500). Plan on the assumption that backups and disaster-recovery copies of that data need to be in Nigeria too, and confirm the scope with your compliance adviser.

That sits on top of an already-tightening framework:

• The Nigeria Data Protection Act (NDPA) 2023 doesn't impose blanket localisation, but Section 41 only allows personal data to leave Nigeria if the recipient is bound by a law, binding corporate rules, contractual clauses, a code of conduct or a certification that gives adequate protection, or if a Section 43 condition applies (such as informed consent or necessity for a contract with the person). Section 41(2) requires you to record the basis for each transfer, and the NDPC's General Application and Implementation Directive (GAID) makes cross-border transfer a mandatory trigger for a Data Privacy Impact Assessment filed with the Commission (Article 28(3)(o)). We could not find any NDPC adequacy decision published as of September 2026, so transfers abroad are a compliance exercise, not a default.
• NITDA's Guidelines for Nigerian Content Development in ICT (in force since August 2019) require sovereign (government) data to be hosted in Nigeria unless NITDA approves otherwise (Digital Policy Alert). The National Digital Cloud Policy released in August 2026 introduces a four-tier sovereign data classification and, according to a Templars summary, confines data residency requirements to defined categories of sovereign data rather than imposing general localisation (Mondaq). NITDA has also said it will start registering, assessing and certifying cloud and digital infrastructure providers from October 2026 under its National Sovereign Cloud Initiative (BusinessDay).
• The Designation and Protection of Critical National Information Infrastructure Order 2024 designates systems including the Bank Verification Number (BVN) database, the National Identification Number (NIN) database and the Nigeria Inter-Bank Settlement System (NIBSS) as Critical National Information Infrastructure, putting them under a stricter security-protection regime (Nairametrics).
• The Nigeria Data Protection Commission (NDPC) is not a paper tiger. In January 2026 it reported concluding 246 investigations and generating ₦5.2 billion in compliance revenue (BusinessDay). It fined MultiChoice Nigeria ₦766.2 million in July 2025 over privacy violations and unlawful cross-border transfers (Nairametrics), and on 25 August 2025 gave 1,368 organisations in banking, insurance, pensions and gaming 21 days to show evidence of compliance (Premium Times).

If your product touches Nigerian payment transaction data or government data, in-country hosting is now a requirement for that data. If it touches health records or large volumes of personal data, you need at least a documented transfer basis for anything that leaves the country, and in-country hosting is often the simpler answer. Either way the question is which hosting option fits your risk profile and budget.

The three real options

1. Fully on-premises

You own and run physical servers in your own facility (an office server room, a bank's data hall, a hospital's IT room).

Pros: Maximum control over physical access, network segmentation, and audit trails — useful for regulators who want to see exactly who touched a server. No recurring colocation or cloud bill; a fixed capital cost. No dependency on a third party's SLA.

Cons: You absorb Nigeria's power reality directly. The national grid collapsed on 23 January 2026 and again days later (BusinessDay), so grid power cannot be your only source: you need diesel or gas generation, batteries, and someone to maintain all of it. In September 2024 BusinessDay reported that rising energy costs, particularly diesel, were constraining data centre operations in Nigeria (BusinessDay). You also carry your own fire suppression, physical security, redundant connectivity, and disaster recovery — expensive to do properly at small scale.

Best fit: Government agencies, large banks, or telcos that already run serious facilities teams and where "the server never leaves the building" is a compliance or political requirement, not just a preference.

2. Colocation in a Tier III/IV Nigerian data centre

You own the hardware (or lease dedicated racks) but house it in a commercial facility built for this — Lagos is the country's hub. A January 2026 market report put Nigeria's data centre market at about $374 million and named Rack Centre, Africa Data Centres, MDXi, MTN Nigeria and Open Access Data Centres among its key operators (GlobeNewswire), and Equinix, which acquired MainOne and its MDXi data centres, has announced a further Lagos build (Data Center Dynamics).

Pros: You inherit professional power redundancy (usually hybrid diesel/gas generation with UPS and battery backup), fire suppression, biometric access control, and — critically — direct cross-connects to Nigeria's internet exchange points and submarine cable landing stations, so latency to Nigerian ISPs and mobile networks is far better than routing through Europe. You keep ownership of the hardware and data, which simplifies audit and jurisdiction questions under the NDPA. Costs are more predictable than running your own facility, since the colo operator absorbs the power and physical-security overhead at scale.

Cons: Still capital-intensive (you're buying and refreshing hardware), and you need in-house or contracted expertise to manage the racks remotely. Expect demand for Lagos rack space to rise as payment participants work towards the CBN's 1 January 2027 deadline, so check availability and lead times early.

Best fit: Mid-size to large fintechs, healthtechs, and enterprises that need clear data residency and strong performance for Nigerian users, but don't want to build and staff their own facility.

3. Local/regional cloud and hybrid setups

This spans a spectrum: Nigerian cloud providers running infrastructure inside local data centres (several colo operators now offer managed "cloud on colo" services), regional cloud availability in nearby markets with contractual data-residency guarantees, and hybrid architectures that keep regulated data (BVN-linked records, payment logs, health data) in-country while using global cloud services for everything else.

Pros: Lower upfront cost than owning hardware, faster to provision, easier to scale up and down. A hybrid model lets you keep the specific data classes that trigger NDPA/CBN localisation duties on Nigerian soil while still using mature global cloud tooling for workloads that aren't regulated.

Cons: You need to be precise about which data actually has to stay local — treating "the cloud" as one undifferentiated blob makes it impossible to show a regulator where each category of data actually lives. Contractual "data residency" claims from a vendor need to be verified against where the physical infrastructure and backups actually sit, not just where the primary region is marketed.

Best fit: Startups and SMEs that need to move fast, plus larger organisations building a genuinely hybrid architecture around specific regulated data classes.

Quick comparison

Where most teams get this wrong

The recurring failure mode isn't picking the wrong hosting tier — it's not knowing which data actually needs to be there in the first place. Backups, logs, analytics pipelines, and third-party SaaS integrations (customer support tools, email marketing platforms, error tracking) routinely re-export "localised" data right back out of the country without anyone noticing, because localisation gets treated as a one-time infrastructure decision instead of an ongoing architectural constraint. A payment processor can put its primary database in a Lagos colo facility and still be out of compliance if its log aggregator ships to a US-based SaaS by default.

This is the kind of gap that shows up in a security review long before it shows up in a regulator's letter: mapping data flows end to end, not just picking a data centre, is the actual compliance work. Our data protection page describes how Wise Hustlers approaches it: identify every place regulated data travels, then design the hosting and integration architecture around that map rather than retrofitting it after a vendor contract is signed.

FAQ

Does the NDPA require all Nigerian data to be stored in Nigeria?

No. The NDPA does not impose blanket localisation. Section 41 instead conditions cross-border transfers on adequate protection (a law, binding corporate rules, contractual clauses, a code of conduct or certification) or a Section 43 condition such as informed consent. Specific rules go further for specific data: the CBN's June 2026 circular for payment transaction data, and NITDA's rules for sovereign (government) data.

What's the actual deadline for payment data localisation?

The CBN's circular of 15 June 2026 (PSS/DIR/PUB/CIR/001/004) sets 1 January 2027 as the date by which banks, mobile money operators, switching companies, payment service providers and other licensed payment participants must store and manage payment transaction data generated in Nigeria within Nigeria.

Is colocation actually cheaper than running my own server room?

Often, once you account for total cost of ownership. Backup generation, fuel, cooling and physical security are fixed overheads that a commercial colocation facility spreads across many tenants, whereas a small in-house server room absorbs them alone. Get quotes for both before deciding; the answer depends on your rack count and power draw.

Can I use a global cloud provider and still comply?

Sometimes, if the data that must stay in Nigeria (such as payment transaction records under the CBN circular) is genuinely hosted and backed up within Nigeria and you can demonstrate that, and any personal data that does leave the country has a documented Section 41 or 43 basis. Marketing claims about "African availability" aren't enough — verify where the primary storage, backups, and any support-tooling exports actually sit, and get it in writing in the contract.

Sources

• The Central Bank of Nigeria's Localisation Directive: Data Protection Compliance Implications — Mondaq
• CBN gives banks and fintechs 6 months to localise payment data — Techpoint Africa
• CBN Circular PSS/DIR/PUB/CIR/001/004 (15 June 2026) — Enebeli and Partners
• CBN's Data Localisation Directive – Compliance Considerations — Legal 500
• Nigeria Data Protection Act, 2023 — NDPC
• NDP Act General Application and Implementation Directive (GAID) 2025 — NDPC
• Data localisation requirement in NITDA's Guidelines for Nigerian Content Development in ICT — Digital Policy Alert
• Nigeria's National Digital Cloud Policy: Key Provisions — Mondaq
• Starting October, Nigeria's certified cloud register will decide which providers can handle banks' sensitive data — BusinessDay NG
• FG designates NIBSS, BVN, NIN databases as critical national infrastructure — Nairametrics
• NDPC fines Multichoice Nigeria N766.2 million — Nairametrics
• NDPC issues compliance notices to banks, insurers, pension and gaming firms — Premium Times
• Trends & Strategies Shaping Nigeria's USD 374 Million Data Center Market 2026-2031 — GlobeNewswire
• Equinix plans $22 million data center in Lagos, Nigeria — Data Center Dynamics
• Rising energy costs hamper data center growth in Nigeria — BusinessDay NG
• Nigeria's power grid collapses for first time in 2026 — BusinessDay NG
• NDPC concludes 246 investigations, generates N5.2bn revenue in show of ironclad enforcement — BusinessDay NG