DATA POLICY ALERT: UNDERSTANDING FG’S NATIONAL DIGITAL CLOUD POLICY (NDCP) 2026

Introduction 

Cloud computing has become the backbone of today’s digital economy, supporting everything from financial services and healthcare to artificial intelligence (AI), education, e-commerce, and public administration. Digital technologies increasingly underpin commercial, governmental, and social activities, making data infrastructure critical to economic development. Cloud computing has quickly become a game-changer in Nigeria, offering flexible, scalable, and affordable ways to store and manage data for businesses, governments, and individuals. Cloud services also allow businesses to store data, run applications, and manage operations over the internet instead of relying on physical systems. 

On 17 August 2026, the Federal Government unveiled the National Digital Cloud Policy 2026 (“the Policy”) through the Federal Ministry of Communications, Innovation and Digital Economy to replace the previous 2019 Cloud Computing Policy. It is meant to build a homegrown cloud and data infrastructure industry, rather than relying on adoption of existing cloud services. The headline goal is to turn Nigeria from a country that merely consumes cloud services into one that builds a competitive infrastructure, investment, skills, and digital services for the global digital market. It further aims to position Nigeria as a cloud and data-hosting hub for West and Sub-Saharan Africa.

Overview

The National Digital Cloud Policy establishes a national framework for the growth, governance and internationalisation of Nigeria’s cloud and data infrastructure. It seeks to attract investment, develop Nigeria as a regional hosting and digital services export hub, modernise government service delivery through disciplined cloud adoption and aggregated purchasing, and apply proportionate sovereignty requirements to the defined category of government and regulated data.

Nevertheless, achieving these objectives will depend on addressing existing infrastructure deficits, strengthening cybersecurity, building digital skills, ensuring effective institutional coordination, and sustaining long-term investment. Successful implementation will require continuous collaboration between government, regulators, private sector stakeholders, investors, and technology providers to transform the Policy’s vision into measurable outcomes for Nigeria’s digital economy.

At its core, the National Digital Cloud Policy seeks to translate Nigeria’s significant domestic market, expanding broadband infrastructure, international connectivity and growing technology talent base into increased investment, local infrastructure capacity, jobs and digital service exports.

The National Digital Cloud Policy is under the regulatory supervision of the National Information Technology Development Agency (NITDA), the regulatory authority for data storage and data management in Nigeria. NITDA proposed the policy in response to the growing concern about data security, privacy, and sovereignty as reliance is heavily placed on foreign service providers. The policy also works collaboratively with existing legislative frameworks such as the Nigeria Data Protection Act and the Cybercrimes Act, in keeping with global regulatory and governance standards. 

Scope of the National Digital Cloud Policy

1. Promotion of Investment in Cloud Infrastructure: One of the central objectives of the Policy is to attract significant domestic and foreign investment into Nigeria’s cloud computing and data centre industry. It creates an enabling environment through fiscal incentives, regulatory certainty, coordinated investment facilitation, and improved access to supporting infrastructure such as energy and connectivity.
2. Digital Sovereignty and Data Governance: Another significant aspect of the Policy is the protection of government and regulated data. Rather than imposing blanket data localisation requirements, the Policy adopts a proportionate and risk-based approach.

Sensitive government information is subject to defined sovereignty requirements concerning residency, security, and control, while ordinary commercial data continues to benefit from an open and competitive cloud market. This balanced approach seeks to strengthen national security without discouraging private sector investment.

3. Regional Digital Services Export: The Policy also positions Nigeria as a regional cloud and digital services hub for West Africa and the broader African market.

By encouraging cross-border digital services, regional interconnection, and alignment with international standards, Nigeria aims to become a preferred destination for hosting, processing, and managing digital services throughout Africa. This objective aligns with opportunities presented under the African Continental Free Trade Area (AfCFTA).

4. Institutional Framework: Implementation responsibilities are distributed among key institutions. The National Information Technology Development Agency (NITDA) is responsible for regulatory oversight and standards, while Galaxy Backbone Limited oversees operational delivery and shared government cloud infrastructure. The Bureau of Public Procurement ensures procurement compliance, while a Sovereign Government Cloud Governance Committee provides strategic oversight and inter-agency coordination. These frameworks contribute to ensure proper governance, compliance and policy administration within and outside jurisdictions.
5. Government Cloud Transformation: The Policy promotes a Cloud-First approach for Federal Ministries, Departments and Agencies (MDAs), encouraging the prioritisation of cloud-based solutions where suitable and compliant with applicable governance requirements. Rather than maintaining fragmented and expensive on-premises systems, government institutions are expected to prioritise cloud-based solutions where appropriate. To support this objective, the Policy proposes coordinated procurement, shared digital infrastructure, and a National Digital Marketplace through which government institutions can procure certified cloud services efficiently.

Challenges 

1. Infrastructure Constraints: Reliable electricity, broadband connectivity, and data centre infrastructure remain critical challenges in Nigeria. Cloud computing depends on resilient digital infrastructure, and persistent power shortages may increase operational costs for service providers
2. Cybersecurity Risks: As more government services migrate online, the risk of cyberattacks, ransomware, and data breaches also increases. The Policy is expected to increase compliance expectations for cloud service providers in relation to cybersecurity, incident management, and data protection obligations.
3. Capacity and Skills Gap: Successful implementation requires skilled professionals in cloud architecture, cybersecurity, artificial intelligence, and data governance. Although Nigeria has invested in digital skills programmes, demand for highly specialised cloud professionals continues to exceed supply.

Implications for Businesses

Although the policy is primarily directed to government institutions and cloud development service providers, the policy also has implications for business practices in the country.  

1.  Review cloud hosting arrangements: The policy encourages a comprehensive review of existing hosting arrangements and ensures compliance in line with NITDA and the underlying policy. This includes assessing where data is hosted, the contractual obligations imposed on cloud service providers, and the extent to which current hosting arrangements satisfy security, availability, and regulatory expectations.
2. Assess data classification and residency requirements: Businesses particularly regulated in sectors such as finance, healthcare, telecommunications, and critical infrastructure should review how data is classified, stored, and transferred. This will enable businesses to properly identify the information categories and ensure compliance with sector-specific regulatory requirements as well as general regulatory requirements.
3. Strengthen cybersecurity governance: Businesses should review their cybersecurity policies, incident response procedures, access controls, and encryption standards to ensure they remain fit for purpose.
4. Monitor NITDA implementation guidelines: Functioning as the regulatory authority, NITDA should be closely monitored for regulatory developments and guidance in policy operations, modifications, and compliance obligations.
5. Revisit procurement and vendor due diligence processes: The policy encourages businesses to conduct risk assessments, procurement re-evaluation, and due diligence review to ensure good standing with appropriate and current governance standards and avoid liability.

Conclusion 

The National Digital Cloud Policy represents one of Nigeria’s most ambitious digital governance initiatives in recent years. While it seeks to accelerate cloud adoption and strengthen digital sovereignty, its success will ultimately depend on effective implementation, institutional coordination and regulatory clarity. For businesses, particularly technology companies, financial institutions, cloud service providers and multinational organisations, the Policy signals that cloud governance is no longer merely an operational consideration but an increasingly important aspect of legal and regulatory compliance. 

As implementing guidelines continue to emerge, organisations should proactively review their data governance frameworks, cloud contracts and compliance strategies to ensure alignment with Nigeria’s evolving digital regulatory landscape. Organisations should assess data-hosting arrangements, review cloud service agreements, evaluate regulatory obligations relating to data residency and cybersecurity, and monitor implementing regulations issued pursuant to the Policy.

This newsletter is provided for general information purposes only and does not constitute legal, regulatory, or professional advice. While reasonable care has been taken in preparing this publication, readers are advised not to rely on its contents as a substitute for specific legal advice. Institutions and individuals are encouraged to consult their legal, compliance, or other professional advisers before acting on any information contained in this publication.