NIGERIA’S NATIONAL DIGITAL CLOUD POLICY: WHAT BUSINESSES NEED TO KNOW
BY ADERONKE ALEX-ADEDIPE & ENIOLA SOGBESAN
Introduction
On 17 August 2026, the Federal Government of Nigeria introduced the National Digital Cloud Policy (the “Policy”), replacing the Nigeria Cloud Computing Policy 2019. The Policy is effective immediately, save for the sovereignty provisions contained in Part III, which remain subject to Presidential approval.
The Policy represents a significant evolution in Nigeria’s approach to cloud computing. While the 2019 policy primarily focused on encouraging the adoption and use of cloud technology, the Policy supports the deliberate development of a domestic cloud and data infrastructure ecosystem in Nigeria.
Among other objectives, the Policy seeks to –
- attract investment in cloud and data infrastructure;
- develop Nigeria as a regional digital services exporter;
- expand and diversify domestic capacity;
- modernize government service delivery and
- secure government and regulated data proportionately.
In this newsletter, we examine the key provisions of the Policy and consider their practical implications for cloud service providers, data centre operators, regulated entities and businesses that use cloud services in Nigeria.
Scope and Application
The Policy establishes a tiered framework which can be broadly understood across three distinct categories:
- General Market Framework: Parts I and IV of the Policy establish the overarching framework applicable to participants in Nigeria’s cloud market. These provisions address matters such as investment, trade, market development and the implementation of the Policy.
- Public Sector: Part II of the Policy is applicable to Federal Ministries, Departments, Agencies and entities exercising public functions on their behalf. State Governments, the Federal Capital Territory, and Local Governments may participate voluntarily under the Policy.
- Sovereign Data: Part III of the Policy is specifically applicable to sovereign data. Sovereign Data in the Policy refers to-
i. data generated by the Federal Government, its MDAs, or by entities performing public functions on their behalf; and
ii. data generated pursuant to a Federal regulation, license, or directives issued by the Federal Government and such data must be expressly designated as sovereign.
Key Policy Incentives
- Investment Incentives
Qualifying Investment may benefit from a range of incentives such as –- import duty exemptions, waivers, or concessions on data centre equipment and
- access to priority status and equivalent tax incentives for qualifying strategic digital infrastructure projects.
- Regulatory Facilitation and Investment Certainty
The Policy recognizes regulatory friction as a material deterrent to infrastructure investment. Accordingly, the Federal Government will among others–- coordinate investment promotion to eliminate duplicative approval requirements and reduce administrative delay;
- establish a single coordinated facilitation point for qualifying cloud and data centre investments; and
- publish the licensing, compliance, and operational requirements applicable to cloud and data infrastructure investments.
- Capital Mobility and Foreign Exchange Incentives
To ensure the effective realization and repatriation of investments, the Policy ensures the following:- lawful repatriation of capital, profits, and dividends in accordance with applicable investment and foreign exchange regulations;
- prompt issuance of certificates for qualifying investments to secure repatriation rights; and
- all earnings from cloud and data services provided to customers outside Nigeria will be treated as export earnings eligible for foreign exchange and export incentives.
- Energy Access
The Policy provides a framework to support cloud and data centers in accessing reliable electricity, including opportunities to utilize renewable and alternative energy solutions.Importantly, the beneficiaries of these incentives are required to commit to capability development programmes, including knowledge transfer and skills development to Nigerians.
Eligibility and Qualification
To be eligible to benefit from incentives under the Policy, cloud and data centers must among other considerations demonstrate –
- deployment, or committed planned deployment, of qualifying infrastructure in Nigeria;
- registration under the Digital Infrastructure Assurance Registration scheme;
- participation in the National Digital Marketplace framework, where seeking government business;
- alignment with national interoperability requirements; and
- compliance with applicable data protection, cybersecurity, and consumer protection obligations.
Sovereign Data Classification
As noted above, Part III of the Policy is applicable to sovereign data which is categorized into four–
| Level | Category | Data Type | Hosting Requirement |
| 4
|
Classified | National security, defence and critical infrastructure | Hosted exclusively on infrastructure physically located in Nigeria under sovereign control, with processing within Nigeria. |
| 3
|
Highly Sensitive | Sensitive personal data, regulated data including financial, biometric, identity and health data. | Stored in Nigeria, with continuous sovereign recovery capability; processing in approved environments subject to safeguards. |
| 2 | Sensitive | Internal government operational data, administrative records, and data that could cause moderate risk if disclosed | May be deployed in hybrid environments, including approved international infrastructure, subject to prior authorization. |
| 1 | Open | Public access data or low risk information with minimal data if disclosed.
|
May be hosted on any compliant infrastructure without residency restriction. |
Implementation Timeline
The Policy will be implemented in phases with an overall timeline of 24 months from the issuance date.
Next Steps
- Cloud providers and data centre operators – Assess eligibility for incentives and the process for registration under the Digital Infrastructure Assurance Registration scheme.
- Regulated entities – While the Policy does not impose general data localization requirements, however given that the category of what constitutes “regulated data” is not exhaustive and includes financial, biometric, identity and health data, this data category should be closely monitored where there is the expansion of the data types.
- Businesses using cloud services: All commercial data remain unaffected by the sovereignty provisions as the Policy provides regulatory certainty for continued use of international cloud services.
Conclusion
The introduction of the National Digital Cloud Policy is an important shift in Nigeria’s digital infrastructure and data governance landscape. By combining investment incentives, regulatory facilitation, domestic infrastructure development and a risk-based approach to sovereign data, the Policy seeks to strengthen Nigeria’s cloud ecosystem while promoting secure and resilient digital services.
The practical impact of the Policy will depend largely on the development of clear implementation guidelines, the achievement of the key performance indicators set out in the Policy, and the Presidential approval of the sovereignty provisions in Part III.
The Policy presents significant opportunities for investment, innovation and digital transformation. Its success, however, will require sustained collaboration among government and other stakeholders to ensure that Nigeria’s cloud infrastructure develops in a secure and commercially viable manner.