Nigeria’s New Cloud Policy Reshapes Business Landscape

The new framework replaces the 2019 Nigeria Cloud Computing Policy, introducing a coordinated approach covering investment, government adoption, and data sovereignty. Olisa Agbakoba Legal (OAL), a firm active in Nigeria’s digital economy, has flagged the policy’s consequential implications for businesses, many of which will now need to re-evaluate their strategies.

Part of a Larger Sovereign Cloud Push

This policy serves as the capstone of the National Sovereign Cloud Initiative (NSCI), implemented alongside several companion instruments including the National Cloud Guideline 2026 and the National Digital Infrastructure Assurance Framework (NDIAF). It also includes an investment focused National Cloud Investment Strategy, and the policy itself prevails in case of any conflict with these supporting documents.

The policy is organized into four parts, but not all of them take effect at the same time.

• Parts I, II, and IV are effective immediately upon publication, covering investment, government adoption, and implementation
• Part III, which addresses the sovereignty framework, still awaits Presidential approval

In practical terms, market development and government adoption mechanisms are already live, while data residency obligations remain pending assent.

Cloud Becomes the Default for Government

Part II makes cloud computing the default choice for government agencies. All Federal Ministries, Departments, and Agencies (MDAs) must now adopt cloud infrastructure for new systems, operationalizing the Cloud First principle first introduced back in 2019.

Galaxy Backbone Limited (GBB) has been designated the primary digital infrastructure provider, responsible for aggregating government demand and operating shared platforms. Procurement for these services will run through a National Digital Marketplace.

The Sovereignty Rules Are Narrower Than They Sound

Part III, the section most commentary has focused on, applies only to what the policy calls sovereign data, meaning data generated by the Federal Government or data that falls under Federal regulation. Most commercial activity sits outside this scope entirely.

Sovereign data is classified into four levels, with the top two carrying the strictest requirements:

• Level 4 (Classified) must be hosted exclusively within Nigeria
• Level 3 (Highly Sensitive) requires storage in Nigeria, though processing can happen in approved environments

The policy leans on proportionality rather than blanket restriction. Residency requirements scale with sensitivity, and less restrictive measures like encryption are preferred wherever they can meet the same control objectives.

Two Questions the Policy Doesn’t Answer

For investors, the policy offers a more predictable pathway than before, including an Approval In Principle (AIP) process and fiscal incentives. But it also acknowledges, on its own terms, two commercial questions it doesn’t resolve: firm foreign exchange facilitation and reliable power supply.

Both issues remain open on the document’s face, and how they get resolved will likely determine whether this policy delivers for investors and Nigerian businesses, or simply becomes another well-intentioned framework waiting on infrastructure that hasn’t caught up yet.

Hashlytics Take

The split timeline here is the part worth paying attention to. Businesses don’t need to wait for Part III to start positioning around this policy since the investment and procurement mechanisms are already active. What’s actually uncertain isn’t the legal framework, it’s whether FX access and power reliability improve fast enough to make the predictability on paper mean anything in practice. Nigeria has written clearer cloud rules before without that translating into infrastructure businesses could actually depend on.