By
Boluwatife Ekundayo, Aminat Adepoju, Kemisola Ajayi and Christiana Okechukwu
Introduction
Cloud computing has transformed the modern digital economy by making information more accessible, adaptable, and efficient than ever before. Businesses can now store, retrieve, and process vast amounts of data remotely, deploy digital products globally, and scale operations without maintaining costly physical infrastructure.[1] With use cases like collaboration, backup, file syncing, testing, and analytics, cloud storage has become central to daily business operations.[2]
Yet, despite its apparent intangibility, the cloud is not borderless. Every piece of data stored “in the cloud” ultimately resides on physical infrastructure located somewhere in the world and subject to the laws and regulatory authority of the jurisdiction in which that infrastructure is located.
By extension, the data stored in the physical infrastructure, such as a data centre, does not exist in a regulation-agnostic vacuum as it is often subject to the laws, regulatory oversight and governmental powers of the jurisdiction in which the physical infrastructure is located. Questions of who can access the data, the standards governing its protection, and the circumstances under which public authorities may lawfully require its disclosure, therefore become central to the location of storage.
As one of Africa’s largest digital markets, Nigeria generates enormous volumes of data daily across sectors. At the same time, increasingly sophisticated cyberattacks and the growing use of digital infrastructure in geopolitical conflicts have heightened concerns about foreign access to strategically important information. Governments around the world are becoming more deliberate about data storage location and the attendant legal implications of storage location.
Nigeria is not left out of this global conversation that highlights the concerns related to on-cloud data storage. Recent regulatory developments, especially the Central Bank of Nigeria’s (“CBN”) recent data localisation requirements for payment transaction data[3], and the Nigerian Communications Commission’s (“NCC”) Cyber Resilience Framework[4] demonstrate an increasing focus on strengthening domestic control over critical digital infrastructure and national data.
In this article, we will examine the concept of cloud storage, data sovereignty and data localisation within the Nigerian context, analyse Nigeria’s emerging approach to data localisation, and consider whether Nigeria’s existing digital infrastructure can adequately support a fully localised digital economy.
The Nature of Cloud Storage
Cloud storage refers to the storage of data digitally, on remote servers, operated by third-party service providers. The third-party providers are responsible for hosting, managing, and securing data stored on their infrastructure.[5]
Cloud storage is developed on the concept of cloud computing – the development of distributed, parallel, and grid computing – which splits a huge computing processing programme into countless subroutines through a network of computers and sends it to a huge system composed of multiple servers for processing.
Cloud storage therefore refers to the collection of a large number of different types of storage devices in a single network through cluster applications, grid technology, or distributed file systems that work together to provide data to the outside world.[6] Cloud storage works by distributing data across data centres, secured with state-of-the-art technologies like encryption and replication to preserve the durability and availability of stored data. Rather than investing in costly physical servers and extensive in-house infrastructure, modern-day businesses increasingly rely on cloud service providers to host vast amounts of data across interconnected networks of servers located around the world.
Due to its peculiarity and nature – synchronisation, flexibility, resilience and dependable access, the cloud has often been described as a borderless ecosystem where information flows seamlessly across continents. Specifically, data can be accessed from anywhere (synchronisation), applications could be deployed across multiple jurisdictions (accessibility), and organisations no longer need to concern themselves with the location of servers or storage infrastructure (cost-effectiveness and flexibility). These characteristics have contributed significantly to the widespread adoption of cloud storage across industries.
The flexibility and accessibility of cloud storage obscure an important reality- data always has a physical location. Every document uploaded to the cloud, payment processed, or customer record maintained on-cloud is stored on physical infrastructure situated within the territorial boundaries of a state. Consequently, the legal framework applicable to that information is often determined by where such data resides.
Today, data location is more than a technical or logistical detail. It has become a strategic legal, economic, and national security issue. This is because every sector in the country, including the government, requires data to work effectively. Financial institutions rely on data to open accounts, process payments, and prevent fraud. Healthcare providers require data to diagnose illness, administer treatment, and maintain medical records. Government agencies depend on it to deliver public services, formulate policy and maintain national security, while technology companies use vast amounts of data to train artificial intelligence systems and develop innovative products.
As data increasingly underpins economic and governmental activities, an important question arises: what categories of data should be permitted to move freely across borders, and what data should remain within a country’s jurisdiction? This question lies at the centre of contemporary debates surrounding data sovereignty and data localisation.
Why Data Location Matters
The growing importance of data location reflects a broader shift in how stakeholders perceive information in the digital economy. Data is no longer viewed merely as an operational resource for private enterprises; it has become a strategic national asset with significant economic, regulatory, and security implications. Data location has consequently also assumed a position of concern in regulatory, national sovereignty, and economic discussions. Enterprises, governments, and even individuals are re-evaluating their cloud storage choices with a sharper focus on geographic transparency, jurisdictional control, and operational autonomy.[7]
Recognising this reality, governments across the world are beginning to adopt policies designed to strengthen domestic control over strategically important information. Strict mandates that require citizen data, financial records, government databases, and critical infrastructure data to remain on physical infrastructure located within their national boundaries are now being enforced. This shift turns location into a non-negotiable aspect of security strategy.[8]
This development has important practical implications for everyday digital activities. Data is increasingly important for simple daily transactions; money transfer using digital technology platforms, telemedicine and hospital appointment bookings, e-commerce and AI assistance for daily payments – all depend largely on the availability and accuracy of personal and non-personal data. The conversation therefore extends beyond the security of data storage platforms. It is increasingly concerned with whether critical information capable of revealing behavioural patterns, economic activity and governmental priorities should routinely be stored and managed outside the territorial boundaries of the state to which it relates.
For regulators, the concerns extend beyond cybersecurity. Data location has become intertwined with regulatory accessibility, supervisory oversight, economic competitiveness, and operational resilience. Stakeholders are consequently re-evaluating their cloud storage decisions with a greater emphasis on geographic transparency, jurisdictional control, and accountability of platform owners.
Data Sovereignty, Data Residency, and Data Localisation
The concepts of data sovereignty, data residency and data localisation are closely related and are frequently used interchangeably. Although they address different aspects of data governance, appreciating their distinctions is essential to understanding contemporary data localisation policies.
Data sovereignty refers to the legal authority exercised over information by virtue of the jurisdiction in which it is physically located. It reflects the principle that data remains subject to the laws and regulatory oversight of the country with which it is most closely connected.[9] Framed as a response to the concepts of “digital colonialism” or “digital imperialism”,[10] it is used to refer to (i) the power to compel compliance with the rules of a particular jurisdiction, and (ii) the power to define the terms of compliance, whereby governments shape how digital firms operate within their jurisdictions.[11]
Contrary to popular perception, data sovereignty does not necessarily require information to remain within a country’s borders. Rather, it is principally concerned with preserving a state’s ability to regulate strategically important information and protect its legitimate national interests. In practice, it is a question of legal control and regulatory oversight, not merely geography.[12]
Data residency, on the other hand, refers to an organisation’s decision to store organisational data within a particular geographical location.[13] Residency refers to where organisational data is stored and the ability of organisations to make that choice. Organisations might store data in a specific location to avoid legal requirements, take advantage of tax regimes, or for performance reasons. Once an organisation chooses a location for its data, it is subject to data sovereignty, that is, the law applicable in that region.[14]
Data localisation goes a step further. It refers to legal or regulatory requirements mandating the transfer of specific types of data outside of a specific location. It is a special case of data sovereignty.[15] It refers to a mandatory legal or administrative requirement directly or indirectly mandating the storage or processing of data within a specified jurisdiction[16] and places emphasis on the physical location of data, as opposed to the prescribed level of protection of certain categories of data.
It is important to distinguish data localisation from data sovereignty. While localisation concerns the mechanisms through which governments exercise regulatory control over strategically important information, sovereignty is concerned with the legal authority that governs that information. The two concepts are complementary but not synonymous.
The objective of data sovereignty is not necessarily to prevent cross-border data transfers. Rather, it seeks to ensure that such transfers do not undermine a state’s ability to regulate its economy, enforce its laws or protect its national interests. This position is reflected in the Nigeria Data Protection Act 2023 (the NDPA) which permits international transfers of personal data where appropriate safeguards exist.[17] The NDPA does not outrightly prohibit cross-border transfers; instead, it establishes conditions designed to ensure that Nigerian data subjects continue to enjoy an adequate level of protection even where their information is processed outside of Nigeria.
Consequently, data sovereignty does not automatically require complete localisation. The appropriate regulatory response will often depend on the nature and sensitivity of the information involved, the regulatory objectives sought to be achieved and the country’s capacity to support the chosen localisation framework.
The Growing Case for Data Localisation
The increasing adoption of data localisation policies is driven by a combination of economic, geopolitical and national security considerations. Recent trends reveal a clear indication that countries and regions see value in having data stored and processed locally. The control of data provides both economic and geopolitical advantages.
One of the primary reasons for the increase in data localisation is the economic value of data. Data has become one of the most valuable resources of the digital economy, and for practical reasons, it becomes imperative for countries to have control over data to dictate their economic destiny.
Governments are becoming increasingly aware that data does not only create value for technology companies; it also drives investment in digital infrastructure. Data centres, cloud services, fibre networks and cybersecurity operations create jobs, attract capital and stimulate innovation. It is therefore not surprising that governments increasingly see domestic data infrastructure as part of their broader economic development strategy rather than merely a technical issue.
Similar to the economic rationale is the concept of geopolitics of data. For developing and developed countries, leadership in the global digital economy is linked to establishing their claims of technological sovereignty – which usually means that advancements in the technological capacity of one nation may threaten the national sovereignty of another. Geopolitics of data reflects the growing perception that nations that are able to localise technological development and control data flows will fare better in the internet governance order. While restricting data flows is publicly justified as an economic strategy, such measures can also have political and social implications, as they affect public opinion and power dynamics. This is a major consideration for stricter cross-border transfer rules and increasing data localisation mandates globally.[18]
Another major motivation for data localisation policies is national security.[19] Digitally stored data may contain personal data and other sensitive information relating to health and property data. Governments are increasingly concerned about the storage of such critical data in jurisdictions where it may be subject to foreign laws or government access requests. Although global cloud providers invest heavily in cybersecurity and often provide security measures that individual organisations cannot easily replicate, issues on the legal control of data have become very topical.
Governments are therefore adopting a restrictive approach towards cross-border flows of such data on the grounds of national security and public order, and to minimise security risks like foreign surveillance and misuse of data by rogue actors.[20] Simply put, localisation is one of the policy tools through which a state seeks to give practical effect to its sovereign authority (digital sovereignty) over strategically important information.[21]
National security concerns have played a prominent role in the enactment of global localisation regulations such as the United States’ Clarifying Lawful Overseas Use of Data (CLOUD) Act, which allows U.S. law enforcement agencies, in certain circumstances, to require US based service providers to disclose data under their control, even where that data is stored outside the United States.[22] This is to effectively curb cybercrime. This and other concerns have arisen in other jurisdictions, prompting governments to reconsider whether certain categories of data should remain within their territorial jurisdiction.
While these security, regulatory, and economic considerations explain the increasing importance of data localisation, the concept is frequently conflated with related notions such as data sovereignty and data residency. The concepts of data sovereignty, data residency, and data localisation are closely related, they address different aspects of data governance. An appreciation of these distinctions is essential to understanding the scope and objectives of data localisation policies.
Nigeria’s Attempt at Data Localisation
Recent regulatory developments in Nigeria suggest a deliberate shift towards strengthening domestic control over strategically important data. The enactment of the NDPA marked an important milestone in digital sovereignty efforts.[23] The NDPA introduced a more robust framework governing cross-border transfers of personal data – requiring the performance of privacy impact assessments, vendor due diligence, adoption of state-of-the-art of security measures, and in some cases, consultation of the Nigeria Data Protection Commission (NDPC), before moving personal data outside the borders of the country.[24] These rules apply to both Nigerian and international digital platform owners, provided the data to be transferred relates to Nigerian citizens.
Although the NDPA[25] does not mandate comprehensive data localisation for all cross-border personal data transfers, it demonstrates an interesting policy shift and an increasing appreciation of the strategic importance of information governance within Nigeria’s digital economy.
More recently, specifically on the 15th of June 2026, Nigeria’s apex bank, the Central Bank of Nigeria (“CBN”), introduced measures requiring payment service providers and other regulated financial institutions to localise payment transaction data within Nigeria.[26] Similarly, the Nigerian Communications Commission (“NCC”) launched its Cyber Resilience Framework to strengthen the resilience of Nigeria’s communications infrastructure against increasingly sophisticated cyber threats.[27] While the NCC Framework does not itself mandate data localisation, it complements Nigeria’s broader localisation agenda by recognising that data sovereignty must be accompanied by resilient domestic digital infrastructure. This is premised on the fact that localising information without investing in cybersecurity and operational resilience is insufficient for an effective data governance regime.
These developments do not suggest an isolation or an unwillingness to participate in the global digital economy. Rather, it reflects an attempt to strike an appropriate balance between two competing realities. On the one hand, businesses depend on globally distributed cloud infrastructure to remain competitive, resilient, and innovative. On the other hand, governments require sufficient control over critical data to discharge their regulatory responsibilities and safeguard national interests. Reconciling these objectives is proving to be one of the defining legal and policy challenges of the digital age.
The CBN’s Payment Data Localisation Directive
Nigeria’s evolving approach to data localisation is perhaps most evident in the CBN’s Circular PSS/DIR/PUB/CIR/001/004 on the Introduction of Market Structure Requirements, Data Localisation, Ultimate Beneficial Ownership Disclosure, and Systemic Oversight Measures in the Nigeria Payments System (the “Circular”).[28] The Circular mandates banks, payment service providers, fintech companies and other participants in the payments ecosystem to store and otherwise process payment transaction data originating from Nigeria is stored within the country, with compliance expected by 1st January 2027.[29] This reinforces the CBN’s approach to payment data, viewing it as part of the country’s critical financial infrastructure, which must be subject to domestic oversight.
Payment transaction data occupies a unique position within Nigeria’s financial ecosystem. Beyond its commercial value, such information enables regulators to supervise payment systems, monitor systemic risks, investigate financial crimes, make accurate economic projections, and maintain the integrity of the country’s financial infrastructure. Localisation requirements therefore reflect broader concerns relating to regulatory accessibility, operational resilience and effective supervisory oversight rather than merely the physical location of servers.
Possible Impact of the Localisation of Payment Data in Nigeria
Financial services are among the most data-intensive sectors of the digital economy. The availability, integrity and accessibility of payment transaction data are central to the effective functioning of modern financial systems. Unsurprisingly, many Nigerian fintech companies have built their operations upon global cloud infrastructure provided by hyperscale cloud service providers such as AWS, Microsoft Azure and Google Cloud.
With the introduction of the Circular, all financial institutions and payment sector participants in Nigeria must ensure the local storage and processing of Nigerian payments data.[30] This is significant for many reasons. Beyond the financial services sector, the Circular demonstrates that data localisation is no longer a mere policy aspiration. Rather, it is becoming a primary regulatory expectation in sectors regarded as critical to the country’s digital economy. It is expected that other critical economic sectors – telecommunications, healthcare, energy, and trade will follow suit in a short time.[31]
As earlier discussed, data localisation is not the only regulatory tool to promote a country’s digital sovereignty. The availability and efficiency of world-class cloud computing infrastructure, and government involvement in this sector is important to a mature digitally sovereign economy.
With more data localisation policies, especially in critical economic sectors, it is also expected that investment in locally owned and managed data centres and cloud computing infrastructure will increase. It is expected that government activities and investment approaches in cloud computing and infrastructure in Nigeria will increase in the coming years.
Should Every Category of Data be Localised?
Nigeria’s recent regulatory developments suggest a fundamental shift in the way regulators view both personal and non-personal data. Increasingly, data is being recognised not merely as an operational or commercial asset, but as a strategic national resource capable of advancing economic, regulatory and national security objectives. This policy approach becomes particularly compelling in sectors that process sensitive, critical or nationally significant information, including finance, telecommunications, healthcare, defence, public administration and trade.
Nigeria’s financial ecosystem, particularly the fintech sector, has experienced tremendous growth over the last few years, characterised by a rapid adoption of digital payment channels.[32] The significance of financial data extends far beyond its commercial value to financial institutions. Payment transaction data provides regulators with valuable insights into consumer spending patterns, economic activity, levels of financial inclusion and broader macroeconomic trends. It enables governments and regulators to make more informed decisions relating to fiscal and monetary policy, financial crime prevention, systemic risk management and economic planning. In this regard, financial data has become one of the most valuable regulatory resources within the digital economy.
In the same vein, telecommunications operators process vast quantities of subscriber information and network metadata capable of revealing movement patterns, communications activity and infrastructure vulnerabilities. Healthcare providers increasingly maintain electronic medical records containing highly sensitive personal information. Government ministries and agencies similarly manage extensive databases relating to taxation, immigration and national identity.
Similarly, telecommunications operators process vast quantities of subscriber information and network metadata capable of revealing movement patterns, communications activity and infrastructure vulnerabilities. Healthcare providers increasingly maintain electronic medical records containing highly sensitive personal information, while government ministries and agencies manage extensive databases relating to taxation, immigration, national identity and public administration.
These datasets extend beyond ordinary commercial information. They reveal important insights into citizens’ behaviour, consumption patterns, demographic trends and broader socio-economic activities that are often indispensable for public policy formulation and regulatory oversight. Consequently, certain categories of data form part of a country’s critical digital infrastructure and may justifiably attract enhanced regulatory protection.
This does not, however, mean that every category of data should be localised. Data localisation should not be viewed as the singular regulatory response to achieving a digitally sovereign economy. Practical considerations, including infrastructural readiness, compliance costs, access to global cloud technologies and the potential impact on innovation, suggest that blanket localisation requirements may be neither commercially desirable nor technologically feasible.
The extent to which data ought to be localised should therefore depend on the category of data involved and the legitimate regulatory objectives sought to be achieved. In practice, different categories of data require different levels of regulatory control. Consequently, the nature and sensitivity of the data will determine the appropriate localisation model and, by extension, the infrastructure necessary to support it.
Comparative regulatory practice demonstrates that data localisation is not a binary policy choice. Governments have adopted varying localisation models depending on the nature of the information involved and the regulatory objectives sought to be achieved. To appreciate the different regulatory approaches available to policymakers, it is useful to consider the principal data localisation models adopted across jurisdictions:[33]
The CBN Circular appears to favour the exclusive local storage and processing model. Research suggests that data localisation models are determined by the category of data sought to be protected, and the broader economic and regulatory goals of the government in question. While non-sensitive (or non-critical) data may be subject to more flexible localisation requirements, sensitive or critical data often attracts stricter localisation obligations. Accordingly, a country’s choice of data localisation model must be informed by the nature of the data in question, its regulatory priorities, and the availability of the technological infrastructure necessary to support the chosen framework.
The question is therefore not whether all data should remain within Nigeria’s borders, but which categories of information are sufficiently strategic to justify localisation requirements and where Nigeria possesses the infrastructural maturity necessary to support a digitally sovereign economy.
Can Nigeria Support a Localised Digital Economy?
A localised digital economy requires considerably more than legislation. Infrastructural readiness like reliable electricity, resilient fibre networks, modern data centres, robust cybersecurity frameworks, and a skilled workforce capable of operating and securing cloud infrastructure, is central to a truly sovereign digital economy.
Nigeria has undoubtedly made significant progress in the development of its digital infrastructure. Increased private sector investment in data centres, submarine cable systems and fibre-optic networks has strengthened the country’s digital ecosystem and positioned it as one of Africa’s leading technology markets.[38]
Despite this progress, fundamental challenges remain. Data centres are highly dependent on reliable electricity supply, high-speed internet connectivity and resilient cybersecurity infrastructure. With Nigeria’s unreliable power supply, cloud infrastructure operators rely on alternative power supply internet arrangements, inevitably increasing operation costs. Similarly, although broadband infrastructure has expanded considerably, access to reliable, high-capacity connectivity remains concentrated in a few commercial centres, this also necessitates alternative internet arrangements, further increasing operation costs. This presents a major challenge for a truly localised digital economy. For Nigeria to achieve a truly localised digital economy, there is need for dependable digital infrastructure that extends across the country, beyond selected urban areas.
Practical implementation of the proposed CBN Circular also presents an additional challenge. Most Nigerian fintech institutions have built their operations on global cloud infrastructure provided by platforms such as Amazon Web Services (AWS), Microsoft Azure, Google Cloud, and Oracle Cloud. These platforms provide mature capabilities, including scalable computing resources, advanced security monitoring, encryption technologies, fraud detection mechanisms, disaster recovery systems, and high-availability architecture. Migrating away from such established infrastructure within a short timeframe would require substantial financial investment, extensive technical restructuring, and careful operational planning, making immediate compliance particularly challenging for many institutions.[39]
Compliance with the CBN localisation directive will ultimately depend upon the availability of sufficient domestic cloud infrastructure capable of processing and storing large volumes of payment transaction data while maintaining appropriate standards of security, resilience and business continuity.
Conclusion
The idea that the cloud exists beyond geography is becoming increasingly difficult to sustain. While cloud computing has transformed the way information is stored and accessed, it has not eliminated the legal, economic or security implications of where information resides. Every piece of data ultimately sits on physical infrastructure that remains subject to the laws and regulatory authority of the jurisdiction in which it is located.
Nigeria’s recent regulatory developments, particularly the enactment of the Nigeria Data Protection Act 2023 (NDPA) and the Central Bank of Nigeria’s data localisation directive for payment service providers, demonstrate that the country is beginning to treat certain categories of data as strategic national assets rather than ordinary commercial data. This reflects a broader global recognition that data has become central to economic development, national security and digital resilience.
At the same time, localisation should not be viewed as an end in itself. A truly localised digital economy depends largely on infrastructure availability and adequacy. Reliable electricity, modern data centres, resilient fibre networks, strong cybersecurity frameworks and a predictable regulatory environment are all essential to making local hosting both commercially attractive and operationally sustainable.
True data sovereignty is not achieved merely when businesses are compelled to keep their data within national borders. It is achieved when a country’s infrastructure, regulatory framework and digital capabilities inspire organisational residency decisions.
Reference
[1] Greeks for Greeks, “Evolution of Cloud Computing” (23rd May 2026) Evolution of Cloud Computing – GeeksforGeeks accessed on 10th July 2026
[2] Microsoft Azure, What is cloud storage retrieved from https://azure.microsoft.com/en-gb/resources/cloud-computing-dictionary/what-is-cloud-storage#:~:text=Cloud%20storage%20stores%20data%20on,to%20preserve%20durability%20and%20availability on 16 July 2026
[3] CBN Circular PSS/DIR/PUB/CIR/001/004 on the Introduction of Market Structure Requirements, Localisation, Ultimate Beneficial Ownership Disclosure Systemic Oversight Measures in the Nigeria Payments System dated June 15 2026
[4] Nigerian Communications Commission Cyber Resilience Framework for Nigeria Communication Sector (CRF-NCS) Version 1.0, February 2026
[5] Google Cloud, https://cloud.google.com/learn/what-is-cloud-storage accessed on 10th July 2026
[6] Alibaba Cloud Knowledge Base, What is cloud storage | Features of Cloud Storage Services retrieved from https://www.alibabacloud.com/en/knowledge/what-is-cloud-storage-features-of-cloud-storage-services?_p_lc=1 on 16 July 2026
[7] Oliver Smith, Cloud Storage has a Border Problem: Why Data Location Matters Now More Than Ever” (Medium, 22nd May 2025) https://medium.com/@oliver.smith.crazy/cloud-storage-has-a-border-problem-why-data-location-matters-now-more-than-ever-6ca0c141aa1b accessed on 10th July 2026
[8] Irina Baghdyan, “The Sovereignty Shift: Navigating Data Residency and Corp IT Solutions in a Borderless Cloud” https://abs.am/articles/corp-it-solutions-for-data-sovereignty accessed on 10th July 2026
[9] Patrick Hummel et al (2021) Data sovereignty: A review. Sage Journals Big Data & Society January-June 1-17 doi http://dx.doi.org/10.1177/2053951720982012
[10] Nothias T (2020) Postcolonial Reflexivity in the news industry: the case of foreign correspondents in Kenya and South Africa. J Commun 70(2):245–273
[11] Qingxiu Bu, Data sovereignty in Africa: steering digital transformation between China and the West. International Cybersecurity Law Review (2026) 7: 131 – 145 https://doi.org/10.1365/s43439-025-00165-1
[12] Rostyslav Fedynyshyn, “Data sovereignty: in-depth guide for compliance and resilience” (N-ix, 6th October 2025) (21) Data sovereignty: in-depth guide for compliance and resilience | LinkedIn accessed on 10th July 2026
[13] Truefoundry. Data residency in the age of agentic AI: How AI gateways enable sovereign scale and compliance. Published May 29, 2026 and retrieved from https://www.truefoundry.com/blog/data-residency on 16 July 2026
[14] Rostyslav Fedynyshyn, (12) Ibid
[15] Cloudian, “What is Data Sovereignty? Challenges and Considerations”, https://cloudian.com/guides/data-protection/data-sovereignty-in-the-cloud-key-considerations/ accessed on 10th July 2026
[16] Svantesson, D. (2020), “Data localisation trends and challenges: Considerations for the review of the Privacy Guidelines”, OECD Digital Economy Papers, No. 301, OECD Publishing, Paris, https://doi.org/10.1787/7fbaed62-en.
[17] Section 441 – 43 Nigeria Data Protection Act 2023 (“NDPA”)
[18] Jyoti Pandai and Jeremy Malcolm, The Political Economy of Data Localization (2018) The Open Journal of Sociopolitical Studies PACO, Issue 11(2) 2018: 511 – 527 DOI: 10.1285/i20356609v11i2p511
[19] Erol Yayboke, Carolina G. Ramos, and Lindsey R. Sheppard, “the Real National Security Concerns over Data Localisation” (23rd July 2021) The Real National Security Concerns over Data Localization accessed on 10th July 2026
[20] Pandai and Malcolm (2018) ibid
[21] Cloudian, “What is Data Sovereignty? Challenges and Considerations”, https://cloudian.com/guides/data-protection/data-sovereignty-in-the-cloud-key-considerations/ accessed on 10th July 2026
[22] Wire, “What the CLOUD Act Really Means for EU Data Sovereignty”, (15th July 2025) https://wire.com/en/blog/cloud-act-eu-data-sovereignty accessed on 10th July 2026
[23] S. 24, 25 of the NDPA
[24] Sections 41 – 43, NDPA 2023
[25] and its implementation directive, the NDPA- Guidance and Implementation Directive of 2025 (or GAID)
[26] Central Bank of Nigeria’s Circular PSS/DIR/PUB/CIR/001/004 on the Introduction of Market Structure Requirements, Data Localisation, Ultimate Beneficial Ownership Disclosure, and Systemic Oversight Measures in the Nigeria Payments System (CBN, 15th June 2026) https://www.cbn.gov.ng/Out/2026/CCD/CIRCULAR%20ON%20INTRODUCTION%20OF%20MARKET%20STRUCTURE%20REQUIREMENTS,%20DATA%20LOCALISATION,%20ULTIMATE%20BENEFICIAL%20OWNERSHIP%20DISCLOSURE,%20AND%20SYSTEMIC%20OVERSIGHT%20MEASURES%20IN%20THE%20NIGERIA%20PAYMENTS%20SYSTEM.pdf accessed on 12th July 2026 (“the CBN’s Circular on the Localisation of Payment Transaction Data 2026”).
[27] Nigerian Communications Commission, Cybersecurity and Cyber Resilience Framework (2026).
[28] Central Bank of Nigeria’s Circular PSS/DIR/PUB/CIR/001/004 on the Introduction of Market Structure Requirements, Data Localisation, Ultimate Beneficial Ownership Disclosure, and Systemic Oversight Measures in the Nigeria Payments System (CBN, 15th June 2026) https://www.cbn.gov.ng/Out/2026/CCD/CIRCULAR%20ON%20INTRODUCTION%20OF%20MARKET%20STRUCTURE%20REQUIREMENTS,%20DATA%20LOCALISATION,%20ULTIMATE%20BENEFICIAL%20OWNERSHIP%20DISCLOSURE,%20AND%20SYSTEMIC%20OVERSIGHT%20MEASURES%20IN%20THE%20NIGERIA%20PAYMENTS%20SYSTEM.pdf accessed on 12th July 2026
[29] Paragraph 2 of the CBN’s Circular on the Localisation of Payment Transaction Data (2026).; Babajide Komolafe, “CBN orders fintechs, banks to localise payment data, caps market dominance”, (Vanguard, 16th June 2026) CBN orders fintechs, banks to localise payment data, caps market dominance – Vanguard News accessed on 10th July 2026
[30] The CBN’s Circular on the Localisation of Payment Transaction Data (2026).
[31] BusinessDay, ‘CBN’s Data Localisation Order May Expand Beyond Banking as Nigeria Eyes Cloud Investment Boom’ (2026).
[32] Financial Inclusion: Nibss’ Role Accelerates Digital Penetration Drive, Media Updates, Nibss, < https://nibss-plc.com.ng/financial-inclusion-nibss-role-accelerates-digital-penetration-drive/ > accessed on 24th July 2026
[33] OECD Trade Policy Paper, “The Nature, Evolution and Potential Implications of Data Localisation Measures” (OECD Publishing, November 2023) https://www.oecd.org/content/dam/oecd/en/publications/reports/2023/11/the-nature-evolution-and-potential-implications-of-data-localisation-measures_249df37e/179f718a-en.pdf accessed on 24th July 2026
[34] OECD Trade Policy Paper, “The Nature, Evolution and Potential Implications of Data Localisation Measures” (OECD Publishing, November 2023) ibid at page 11
[35] OECD Trade Policy Paper, “The Nature, Evolution and Potential Implications of Data Localisation Measures” ibid
[36] OECD Trade Policy Paper, “The Nature, Evolution and Potential Implications of Data Localisation Measures” ibid
[37] OECD Trade Policy Paper, “The Nature, Evolution and Potential Implications of Data Localisation Measures” ibid
[38] Adeyemi, Adepetun, “Will fibre, satellite revolutions raise telcos’ bars in 2026?”, (The Guardian, 14th January 2026) https://guardian.ng/technology/will-fibre-satellite-revolutions-raise-telcos-bars-in-2026-2/ accessed on 24th July 2026
[39] Paul Balo, “CBN’s Data Localisation Directive Puts Nigerian Fintechs in A Cloud Dilemma” (10th July 202 CBN Data Localisation Directive and Nigerian Fintechs accessed on 10th July 2026
