Nigeria is moving deeper into a new phase of digital regulation as authorities push businesses handling sensitive information to store critical data within the country.

The drive, commonly referred to as data localisation, is being shaped by regulatory requirements from the Central Bank of Nigeria (CBN), alongside standards and certification frameworks developed by the National Information Technology Development Agency (NITDA).

The policy is expected to have far-reaching consequences for banks, fintech companies, technology startups and other businesses that rely heavily on cloud infrastructure.

The financial services industry is at the centre of the current localisation push.

Under the CBN’s requirements, banks, payment service providers, mobile money operators and fintech companies are expected to ensure that locally generated payment transaction data is stored and managed within Nigeria by January 1, 2027.

The move is intended to give Nigerian regulators greater oversight of critical financial information and reduce reliance on infrastructure controlled by foreign jurisdictions.

NITDA has also developed certification and registration frameworks covering cloud service providers, data centres and other technology infrastructure providers, creating a regulatory structure for companies seeking to provide local hosting services.

Although the immediate focus is on financial services, the broader direction of policy suggests that other strategically important industries could eventually face similar requirements.

Sectors such as healthcare, telecommunications, oil and gas and manufacturing are among those that could see greater emphasis on domestic data storage as Nigeria’s digital economy expands.

For technology startups and smaller businesses, however, the transition could present significant challenges.

Many young companies rely on international cloud platforms because of their scalability, pricing and ease of access. Moving databases and other critical infrastructure to locally certified facilities could therefore require additional spending on migration, cybersecurity, technical support and compliance.

For startups operating with limited capital, these costs could become a significant burden.

At the same time, the policy could create new opportunities for Nigeria’s growing data-centre and cloud-computing industry.

Increasing demand for local hosting is expected to encourage investment in domestic infrastructure, potentially leading to greater capacity, new technology jobs and the expansion of cloud services across major commercial centres.

Supporters of the policy argue that keeping sensitive information within Nigeria could strengthen regulatory oversight and improve the country’s ability to respond to cyber incidents.

Locally hosted financial and personal data would be subject to Nigerian laws and regulatory processes, potentially making investigations into data breaches and unauthorized access more straightforward.

The policy could also reduce some of the risks businesses face from sudden changes in foreign regulations, international service restrictions and fluctuations in the cost of overseas cloud subscriptions.

However, data being physically located in Nigeria does not automatically make it secure.

Cybersecurity experts have repeatedly stressed that strong encryption, access controls, monitoring systems, backup infrastructure and effective data-governance practices are just as important as the physical location of a server.

For ordinary Nigerians, the impact could be less visible but potentially significant.

Financial transactions, identity information and other sensitive personal data increasingly move through digital platforms. Stronger local oversight could give regulators greater ability to investigate how such information is collected, stored and transferred.

Local data centres could also reduce the physical distance between users and digital services, potentially improving latency and the speed of some online transactions.

But consumers could ultimately bear some of the costs if businesses pass increased compliance and infrastructure expenses on to customers through higher service charges.

Nigeria’s data localisation policy reflects a broader global push by governments to exercise greater control over critical digital infrastructure and information.

For policymakers, the objective extends beyond where servers are physically located. It is also about strengthening cybersecurity, developing domestic digital infrastructure and reducing dependence on foreign technology ecosystems.

For businesses, however, the challenge will be meeting regulatory requirements without allowing compliance costs to undermine innovation or make Nigerian technology companies less competitive.

As the 2027 deadline approaches, the success of the policy may therefore depend on how effectively Nigeria balances digital sovereignty, cybersecurity, affordability and the need for a globally competitive technology sector.