In June 2026, the CBN directed that payment transaction data generated in Nigeria be stored and managed within Nigeria by January 1, 2027, a narrow, sector-specific mandate, but a clear signal of where regulatory thinking was headed. Nigeria’s newly released National Digital Cloud Policy confirms that signal wasn’t isolated. It moves in the same direction, but at national scale: not one sector’s residency requirement, but a framework for how the country classifies, protects, and governs digital infrastructure and data across the entire economy.

Read quickly, the policy looks like a sovereignty document: classification tiers, residency requirements, a Presidential approval gate. Read carefully, it’s something more interesting: a bet that Nigeria can secure the narrow slice of data that genuinely needs protecting, without closing itself off from the capital, capability, and market access an open digital economy depends on. The Federal Ministry has attached real numbers to that bet: US$250 million in private investment targeted within 12 months of the policy’s issuance, rising to US$750 million within 24 months, backed by the fiscal and regulatory incentives set out below.

Sovereignty, narrowly defined

Sovereign data is defined narrowly: government-generated data, or regulated data specifically designated as sovereign, not assumed to be by default. Designation requires a proposal to a governance committee, an assessment against defined principles, and for the most sensitive tiers, Presidential approval.

Tellingly, the asymmetry favors openness: relaxing a requirement is administrative, while tightening one requires the highest level of government sign-off. That tells you where the real risk is believed to lie, not in too little control, but in control creeping outward into a de facto localization mandate.

The four-tier classification system reflects the same discipline. Only Level 4, classified, national-security-grade data, must sit entirely within Nigeria. Level 3 (financial, health, biometric, identity data) requires data at rest in Nigeria with recoverable capability but permits processing elsewhere under safeguards. Level 2, internal government operational data and moderate-risk records, may be deployed in authorized hybrid environments, including approved international infrastructure. Everything else, the overwhelming majority of data generated in the economy, is unrestricted. This gives the CBN conversation a clearer framework: not “everything stays in Nigeria,” but proportionate control matched to actual risk.

Learning from 2019

Nigeria tried Cloud First before. The 2019 policy adopted the principle and largely failed to implement it: no dedicated funding, no enforcement mechanism, no coordinated demand. This policy pairs the mandate with dedicated budget lines, a ringfenced Anchor Capacity Fund, and enforcement teeth: NITDA can withhold ICT project clearance for non-compliant systems. Whether it succeeds where the last one stalled depends entirely on whether these mechanisms are funded and applied with the discipline promised.

An open bet on regional leadership

The policy is explicit about what it refuses to do: it doesn’t restrict where commercial data may be hosted, doesn’t discriminate by provider nationality, and doesn’t require Nigerian infrastructure for commercial workloads. That openness is the mechanism through which the policy pursues its most ambitious goal: positioning Nigeria as the hosting and interconnection point for West Africa and the wider Sub-Saharan region.

The logic is straightforward. Nigeria combines the region’s largest internet subscriber base, eight international submarine cable landings, and a deepening talent pipeline. Operators already positioned at these landing points, including Rack Centre, sit on precisely the geography this policy is betting regional traffic will move toward. Workloads currently served from Frankfurt or London could instead be served from Lagos or Abuja, with settlement retained on the continent.

A country can’t credibly host its neighbours’ data while restricting its own, and Nigeria’s openness makes it a genuine regional enabler rather than a sovereign enclave. The talent pipeline this depends on is where industry and policy are already converging: the 3MTT programme sits alongside operator-led training initiatives, including Rack Centre’s own Academy, feeding trained personnel directly into the environments this policy is trying to scale.

Logic alone doesn’t move regional traffic, though. It requires functioning Internet Exchange Points and real peering relationships. This is where policy ambition meets operational reality.

Building beyond Lagos

Nigeria’s data centre capacity sits overwhelmingly in Lagos today. The policy treats that as an opportunity to correct, backed by Project BRIDGE, the Federal Government’s 90,000km fibre backbone and one of Africa’s largest broadband investments. Seven regional rings will connect all six geopolitical zones, reaching all 774 local government areas, the connectivity precondition regional data centre hubs have historically lacked.

Between the National Data Park at Egbin, anchored to 1,320MW of power and deep-sea cable access, and a backbone extending toward underserved regions, the policy sets up a genuine two-track path: a flagship hub where scale already exists, and a widening map of viable secondary locations as the backbone reaches them.

The energy provisions add a quieter second dimension: incentives apply preferentially to facilities integrating renewable generation, storage, or verified emissions reductions, alongside the dedicated power support every facility needs. Operators already diversifying their generation mix, Rack Centre’s own move toward gas and solar among them, are building in the direction this policy is trying to incentivize the wider market toward.

Interoperable infrastructure

Strip away the sovereignty language and a quieter argument runs through the document: infrastructure should be interoperable, portable, and non-exclusive. GBB’s aggregation role is explicitly barred from becoming a market-exclusion mechanism. Even sovereign workloads must avoid “exclusive dependency on a single provider.”

The policy never says “carrier-neutral” or “cloud-neutral.” It doesn’t need to. It’s describing the operational requirements neutral, multi-provider infrastructure already exists to deliver. Facilities built from the outset on that model, Rack Centre among them, are, in effect, already structured for what the policy is asking the rest of the market to become.

What this means for data centre players

For operators already in the market, this policy formalizes a direction the better-positioned players have already been moving in.

• Registration is no longer optional for operators seeking government business: incentives and marketplace listing all run through the Digital Infrastructure 

Assurance Registration scheme, with the national certification platform planned for operation from October 2026.

• Neutrality stops being a differentiator and becomes table stakes, particularly for facilities courting government or regulated workloads. 

• Energy strategy becomes an investment case, not just an operating cost: facilities that have diversified generation are better placed to capture preferential 

incentive treatment. 

• Location becomes a genuine competitive variable again as Project BRIDGE extends backbone capacity beyond Lagos.

• Capability development is written into the incentive framework itself: operators with an existing talent pipeline are simply better positioned to qualify for and 

sustain what’s on offer.

None of this rewards operators for having anticipated the policy. It rewards operators for having built the right way regardless of what the policy eventually said.

What to watch

This policy will be judged less by its text than by its execution over the next 24 months:whether the Anchor Capacity Fund is actually disbursed, whether NITDA’s enforcement mechanisms are used, whether Project BRIDGE translates into genuinely distributed hosting capacity, and whether the “transitional” language around GBB’s private partnerships holds in practice.

For now, the policy deserves credit for a genuinely disciplined attempt to thread a difficult needle: protecting what needs protecting without pretending the rest of the digital economy needs the same treatment. Whether Nigeria’s institutions can execute that discipline consistently, under real fiscal and political pressure, is the story that hasn’t been written yet.